Criminal groups are breaking into corporate cloud accounts not to steal data, but to steal artificial intelligence capacity, running up enormous bills on the victim’s tab. A new report from Google’s Threat Intelligence Group (GTIG), summarized this week by TechRadar, describes a fast-maturing criminal practice known as LLMjacking, and says LLMjacking attacks have grown steadily more popular over the past couple of years as the price of using frontier models has climbed.
The mechanics are simple enough to explain in a sentence: someone else uses your AI subscription, and you get the invoice. The scale is what makes it painful. Google says victims can accumulate six-figure charges in minutes rather than the slow drip associated with older forms of resource theft.
How LLMjacking Attacks Begin
According to the GTIG report, most groups start in one of two places: publicly exposed LLM endpoints, or valid LLM API keys obtained by other means. In many cases, Google says, attackers use exposed or stolen cloud identity tokens — IAM credentials, service account keys, GitHub Personal Access Tokens and active session tokens — to establish an initial foothold inside a target organization’s infrastructure.
From there, GTIG says, the intruders “systematically work” to escalate privileges, solidify their access, and identify targets for further compromise. The objective is not espionage or extortion. Google defines the endgame as “the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.”
That last element matters, because it means the abuse is not limited to API calls. Attackers who gain enough control over a cloud project can provision GPU hardware outright, turning a victim’s account into general-purpose AI compute for whatever the operator wants to run.
Six-Figure Bills in Six Minutes
Google draws a direct contrast with cryptojacking, the better-known practice of hijacking machines to mine cryptocurrency. With cryptojacking, token mining is relatively slow and steady, and time has to pass before charges stack up. With LLMjacking attacks, Google says, costs can go into six digits in six minutes.
One tracked actor illustrates the point. “Upon acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 in billing charges,” Google says in the report.
A second actor took a more deliberate approach to maximizing throughput, and Google describes it in detail:
“Another threat actor subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, the threat actor deployed a “burn and rotate” strategy, continuously creating and deleting short-lived service accounts while auditing the cloud provider’s billing interface to monitor financial impact.”
The detail about auditing the billing interface is notable: the attacker was watching the victim’s own cost dashboard to gauge how much damage was being done and how long the access might last before someone noticed the cloud billing charges.
Proxies, Backdoors and a Persona Called D1337-KAIROS
In some cases, GTIG found, threat actors used the access they had stolen to host their own proxy endpoints and agentic workloads inside victim environments. Google says one actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs, rebranded under a persona known as D1337-KAIROS.
That same actor deployed a containerized backdoor that queried an upstream LLM to reason through instructions and execute commands locally — an attack component that outsources its own decision-making to a model.
A Criminal Market With Its Own Middlemen
Google describes the LLMjacking ecosystem as young but growing fast and maturing even faster, with a visible division of labor already in place. Some groups specialize in establishing initial access to compromised environments. Others, which Google calls LLM Mixers, manage downstream monetization: they operate as a routing gateway that proxies, aggregates and resells unauthorized LLM access to underground subscribers.
“In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space,” Google said.
Using open source API gateways and custom relay infrastructure, Google says, the attackers were able to pool stolen credentials, meter usage, and hide where requests really originated. For a downstream buyer, the result looks like a discounted subscription to a premium model. For the organization footing the bill, it looks like an unexplained spike in consumption.
The underlying driver is cost. Threat actors are already using large language models across nearly every stage of an attack, from researching potential victims to developing malware and automating attacks, and frontier model access is expensive. Stealing tokens removes that line item. The economics echo broader anxiety about the price of the AI buildout, which has rattled investors watching tech stocks under renewed AI scrutiny and communities weighing the cost of new data center construction.
What Google Advises Defenders to Do
Google expects threat actors to “increasingly prioritize” LLMjacking at the expense of other resource theft practices, and its recommendations are aimed at closing the visibility gap that makes the abuse profitable. The report frames LLMjacking attacks as a financial problem as much as a security one.
- Increase visibility into LLM platforms, so model usage is monitored the way other cloud spend is.
- Prioritize detection of modifications to LLM accounts and services.
- Treat any unauthorized enablement of a model service as a critical security event.
- Enforce the principle of least privilege, ensuring accounts and users hold only the permissions they need to do their jobs.
The practical warning embedded in that list is that many organizations have made AI services trivially easy to switch on inside their cloud environments — which is exactly what makes a stolen key so valuable. Google’s guidance treats an unexpectedly enabled model service as an incident in its own right, not a billing anomaly to be reconciled later.
TechRadar’s write-up of the GTIG findings is available here. For security teams, the takeaway is that LLMjacking attacks give credential hygiene a direct and immediate financial dimension: a leaked service account key is no longer just a data risk, it is a spending risk that can escalate faster than most monitoring thresholds are set to catch.
