Llmjacking - GoKawiil

Google flags surge in 'LLMjacking' attacks stealing AI account credentials

Google Threat Intelligence Group analyst John Hultquist told the Financial Times that his team has observed a major increase in LLMjacking throughout 2026. The technique involves criminals stealing API keys or login credentials to hijack businesses' AI accounts, exploiting high or unlimited usage limits to run up token costs or misuse compute resources without paying.

zdnet.com · 2026-09-29

SOCRadar finds AI login credentials stolen from 80,000+ organizations

SOCRadar's AI Identity Exposure Report analyzed over one million infostealer records tied to AI services across more than 80,000 corporate domains, narrowing to 482 major enterprises. The study found 5,434 stealer-log records linked to 1,500 corporate email addresses, with 295 of the 482 companies appearing in stealer logs within the last 90 days, and ChatGPT/OpenAI accounts making up roughly 90% of all captured records.

bleepingcomputer.com · 2026-09-28