Google's Threat Intelligence Group and Mandiant found that attackers are stealing API keys and exploiting exposed LLM endpoints to resell unauthorized access through services called LLM mixers. Victim organizations have seen fraudulent usage spike past 1,000 requests per second, with some racking up over $100,000 in charges in a single day and cumulative losses reaching $1 million. One service, Jet Night, reportedly passed nearly $1 million in token costs to a single victim after executing more than 500,000 API calls in under eight hours.
bleepingcomputer.com
· 2026-11-03
The Department of Justice announced charges against five people involved in a scheme that used stolen identities and AI to pose as college students and collect federal student aid. Investigators seized over $750,000 in cryptocurrency linked to a network of Kenyan nationals, describing it as the first international seizure of its kind tied to this type of fraud. The scheme involved buying victims' personal data, filing fraudulent FAFSA applications, and funneling leftover loan money through US-based bank accounts.
arstechnica.com
· 2026-10-30
Consumer group Which? created a fake Booking.com listing for 10 Downing Street, complete with a bogus review mentioning Larry the cat, to test the platform's fraud detection. The listing remained live for two months before Booking.com removed it, despite obvious signs it was fraudulent.
bbc.co.uk
· 2026-09-02
GoKawiil