GoKawiilGoogle: Stolen Cloud Credentials Fuel 'LLMjacking' Reselling Scheme, Costing Victims Up to $1M
Google Threat Intelligence Group and Mandiant report that cybercriminals are stealing access to commercial large language models through compromised cloud credentials and reselling that access on underground markets. In some cases, fraudulent usage charges topped $100,000 in a single day, with total costs to a victim organization reaching $1 million before the compromised access was cut off.
GoKawiil's interpretation of the reporting above, not reported fact.
The report suggests LLMjacking has evolved from opportunistic abuse into an organized criminal business model, drawing in financially motivated groups across multiple regions because it can generate large payouts quickly compared to slower-burning schemes like cryptojacking. This could push companies to tighten controls on API keys, service accounts, and cloud identity tokens, which researchers identify as the primary entry points attackers exploit.
- Attackers steal cloud credentials or exposed API keys to hijack access to commercial LLMs.
- Some victims faced over $100,000 in fraudulent usage charges in a single day, totaling up to $1 million.
- Google researchers say multiple financially motivated criminal groups worldwide are now running LLMjacking as an organized revenue stream.
Source: darkreading.com — Elizabeth Montalbano, 2026-11-03
Published there as: “LLMJacking Emerges as Thriving Cybercriminal Enterprise”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.