As cited
Copy frozen at (site build).
threat intel
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Mandiant and Google's Threat Intelligence Group documented a campaign in 2026 in which threat actors compromised enterprise cloud and large language model (LLM) infrastructure to monetize stolen resources through tactics known as LLMJacking. Initial access typically leveraged exposed or stolen cloud identity tokens, service account keys, and LLM application programming interface (API) keys, with attackers then escalating privileges and establishing persistence to abuse LLM services at scale. The criminal ecosystem includes specialized threat clusters and intermediaries called LLM Mixers that resell unauthorized LLM access through underground channels, generating fraudulent charges exceeding $1 million at some victims before detection.
Why it matters: Organizations using cloud LLM services in finance, retail, technology, and transportation face immediate financial exposure from compromised API keys and misconfigured cloud identity, with threat actors able to accumulate six-figure charges in hours; defenders must enforce credential hygiene, least privilege access, rate limiting, and patch CVE-2026-40217 in LiteLLM gateways to prevent privilege escalation to admin access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Mandiant and Google's Threat Intelligence Group documented a campaign in 2026 in which threat actors compromised enterprise cloud and large language model (LLM) infrastructure to monetize stolen resources through tactics known as LLMJacking. Initial access typically leveraged exposed or stolen cloud identity tokens, service account keys, and LLM application programming interface (API) keys, with attackers then escalating privileges and establishing persistence to abuse LLM services at scale. The criminal ecosystem includes specialized threat clusters and intermediaries called LLM Mixers that resell unauthorized LLM access through underground channels, generating fraudulent charges exceeding $1 million at some victims before detection.
Why it matters: Organizations using cloud LLM services in finance, retail, technology, and transportation face immediate financial exposure from compromised API keys and misconfigured cloud identity, with threat actors able to accumulate six-figure charges in hours; defenders must enforce credential hygiene, least privilege access, rate limiting, and patch CVE-2026-40217 in LiteLLM gateways to prevent privilege escalation to admin access.
- Source published
- First seen by Cybersecurity Tracker