Cybercriminals are exploiting the growing popularity of artificial intelligence by taking over companies’ AI accounts and cloud credentials. They then run expensive AI workloads through those accounts, and the victims are left with the bill. Google’s Threat Intelligence Group (GTIG) says this method, known as LLMjacking, can produce more than $100,000 in cloud charges within minutes.
How attackers gain access to AI accounts
Attackers typically start by searching for exposed AI endpoints or by stealing API keys and cloud credentials. These include identity tokens, service account keys, GitHub personal access tokens and active session tokens. Once inside a company’s systems, they try to expand their privileges, stay in place for as long as possible and locate valuable AI resources.
The aim is to turn that access into money. Attackers may run their own AI workloads, send requests through hijacked accounts or sell access to other people. Google describes this as the monetisation and resource hijacking of foundation models, carried out through token proxying, automated model streaming and GPU provisioning.
Fast financial damage and real-world cases
Google distinguishes LLMjacking from cryptojacking, which tends to drive up costs gradually. With LLMjacking, the financial harm can arrive almost immediately. Google reports that a group it calls UNC6993 generated over $100,000 in charges after obtaining LLM API keys and switching on services in a victim’s cloud project.
In another case, attackers registered compromised accounts for pay-as-you-go plans, selected premium AI models and launched large volumes of inference workloads. To avoid rate limits, they repeatedly created and deleted temporary service accounts while monitoring the victim’s billing dashboard.
Specialised criminal groups and recommended defences
Google says LLMjacking is becoming a specialised branch of cybercrime. Some groups concentrate on breaking into company systems, while others, which it calls “LLM Mixers”, operate gateways that gather stolen credentials, relay requests and sell unauthorised AI access to underground buyers.
GTIG expects cybercriminals to focus more on LLMjacking as the market for AI services expands. Google advises organisations to closely monitor their AI platforms and to treat any unauthorised change to AI accounts or services as a serious security incident. It also recommends applying the principle of least privilege, so that users and accounts hold only the permissions they genuinely need.
