Stolen Cloud AI Keys Hit Retailers and Tech Groups with Million Dollar Bills
In this article (9)
Intruders who breach corporate cloud accounts are quietly activating dormant artificial intelligence tools and running models at company expense, running up bills exceeding 100,000 dollars in a day.
Investigations carried out across 2026 by Mandiant and the Google Threat Intelligence Group revealed intrusions across Asia Pacific, North America and South America that reached cumulative costs of up to 1 million dollars before victims spotted the leaks. The compromises struck retail, transportation, financial services and technology companies that had adopted large language model architectures into their systems.
How Illicit Resellers Drain Foundation Models
The campaign, dubbed LLMJacking, relies on a distinct commercial division of labour within cybercrime rings. One group specializes in penetrating corporate environments to harvest credentials, while a separate tier operates illicit platforms known as LLM Mixers to resell that raw model compute to third-party subscribers.
One service, trading under the name Jet Night, offered paying customers unlimited subscriptions for about 60 dollars a month to access premium foundation models. Comparable commercial access carries legitimate pricing between 100 and 250 dollars. Security investigators determined the syndicate could only sustain that price differential by powering the backend with stolen enterprise credentials.
During a single intrusion linked to the network, an unauthorized actor channeled more than 500,000 queries to foundation models in under eight hours. The targeted enterprise absorbed an unauthorized token bill approaching 1 million dollars before discovering the drain. Jet Night subsequently recorded sudden outages on its Telegram broadcast channels whenever compromised businesses identified the breach and revoked the active keys.
Another unauthorized syndicate set up a lookalike domain disguised as an internal corporate host, routing the victim organization’s application programming interface quotas into a commercial resale front operating as newapi.pro.
The Shift From Cryptojacking to Token Hijacking
Retailers and consumer tech operators have spent years guarding compute fleets against illicit cryptocurrency mining, but model hijacking works at vastly accelerated speed. Cryptojacking trickles away compute slowly to evade system detection, whereas LLMJacking generates massive spikes in fraudulent cloud charges in a matter of hours.
“Security investigators determined the syndicate could only sustain that price differential by powering the backend with stolen enterprise credentials.”
Investigators noted that actors reach their goals through token proxying, automated model streaming and unauthorized graphics processing unit hardware provisioning. Rather than manipulating consumer-facing chatbots to spit out rogue lines of code, the attackers bypass the store front-end entirely to tap backend infrastructure.
For retail and digital commerce platforms in Asia that connect real-time product search, automated customer query desks and dynamic inventory to foundation models, the financial exposure sits directly in the operating budget. Cloud quotas linked to corporate credit accounts or open enterprise billing agreements allow perpetrators to cash out instantly through black-market resale while the operator absorbs the invoice.
Stolen Keys and Exposed Gateways
Initial penetration rarely requires novel zero-day attacks. Threat groups scrape publicly exposed GitHub repositories for stray application programming interface keys, running minute test queries designed to avoid triggering usage alerts.
Most intrusions stem from compromised cloud infrastructure credentials, including unprotected service account keys, active session tokens and corporate GitHub authorization tokens. A group tracked as UNC6993 gained access to a commercial cloud instance via a misconfigured service account credential, quickly bridging across into internal model endpoints. The same operators established a fraudulent registration portal for model developers, tricking visiting engineers into submitting live access tokens that circumvented multi-factor authentication controls.
Once inside a corporate network, attackers search database tables and data warehouse systems for deeper administrative secrets, occasionally disguising backdoor accounts as internal cost-optimization utilities. In another instance, attackers targeted a vulnerability logged as CVE-2026-40217 inside a LiteLLM routing gateway, escalating basic user credentials into root administrative control.
Dormant Services Turned on by Intruders
In multiple forensic investigations conducted by Mandiant, the targeted companies had left their high-tier machine learning services deactivated. Intruders used administrative cloud credentials to switch on the dormant model engines, initiating high-frequency automated requests within minutes.
The findings indicate that monitoring routine endpoint activity is no longer sufficient for digital commerce operators running hybrid cloud stacks. IT departments now face the operational reality that unmonitored API limits directly threaten gross margins, turning routine cloud administration into an immediate balance-sheet liability.
Enterprises running production workflows across multiple public cloud providers must track anomalous model activation alerts and enforce hard spend caps on machine learning billing accounts to catch breaches before usage tallies reach six figures.
Questions & Answers
Q.How do cybercriminals profit from hijacked corporate cloud credentials?
How do cybercriminals profit from hijacked corporate cloud credentials?
Syndicates run illicit resale platforms known as LLM Mixers, such as Jet Night, which sell cheap model access to third-party subscribers. Attackers power these cut-price services using stolen enterprise credentials and API quotas, pocketing subscription fees while victim businesses absorb token invoices that can approach one million dollars.
Q.How does LLMJacking differ from traditional cryptojacking?
How does LLMJacking differ from traditional cryptojacking?
Unlike cryptojacking, which consumes compute power slowly to avoid triggering internal alerts, LLMJacking creates enormous spikes in cloud charges over just a few hours. Attackers bypass consumer-facing front ends completely, using automated streaming, token proxies and unauthorised hardware provisioning to target backend foundation models directly.
Q.Which security weaknesses are attackers exploiting to breach these accounts?
Which security weaknesses are attackers exploiting to breach these accounts?
Penetrations rarely rely on novel zero-day exploits, depending instead on exposed GitHub repositories containing API keys, misconfigured service accounts and active session tokens. Attackers have also targeted specific routing gateway vulnerabilities, such as CVE-2026-40217, and set up fake developer portals to harvest tokens and bypass multi-factor authentication.
Q.What steps can digital commerce operators take to limit their financial exposure?
What steps can digital commerce operators take to limit their financial exposure?
Enterprises must implement hard spend caps on machine learning billing accounts and actively monitor for anomalous model activations. Because intruders frequently activate dormant high-tier model engines, security teams can no longer rely on routine endpoint monitoring alone and must track unmonitored API limits across their hybrid cloud environments.
Reader pulse
Are your cloud machine learning accounts protected by hard spend caps?
20,496 votes so far