Stolen large-model quota is being resold: Google discloses LLMjacking, with single-day bills above $100,000
A November 2 report from Google Threat Intelligence Group and Mandiant disclosed multiple LLMjacking intrusions in 2026: attackers hijacked companies' large-model access, with fraudulent bills above $100,000 in a single day in individual cases and $1 million cumulatively; the main entry point was leaked cloud identity tokens, with UNC6993 and the LiteLLM vulnerability CVE-2026-40217 among the cases, and stolen quota resold through LLM Mixers such as Jet Night.
- 01THE REPORT — Google Threat Intelligence Group and Mandiant published their LLMjacking report on November 2, disclosing multiple 2026 cases of hijacked corporate large-model access.
- 02THE CONFIRMATION — The Hacker News' November 3 report checked the core figures, group designations, vulnerability number and Jet Night resale details against the official report and found them consistent.
- 03THE WATCHPOINT — Whether companies fold large-model usage spikes into real-time security alerting, and whether cloud and model providers ship default protections against anomalous enablement and excessive calls.
WHAT HAPPENEDWhat Happened
Google Threat Intelligence Group and Mandiant published the report 'The Rise of LLMJacking' on November 2, disclosing multiple intrusions handled in 2026 in which attackers hijacked companies' access to large models and left the compute bill with the victim. In individual cases, fraudulent bills exceeded $100,000 in a single day, and some organisations ran up $1 million in cumulative bills before cutting off access. Affected organisations were spread across North America, South America and Asia-Pacific, spanning finance, retail, technology and transport.
The main entry point was not the chatbot front end but back-end model resources. The most common initial access was leaked or stolen cloud identity tokens: IAM credentials, service account keys, GitHub personal access tokens and valid session tokens. A group designated UNC6993 entered cloud instances via misconfigured service account keys, obtained large-model API access, and built a fake portal that lured users into pasting JSON payloads containing valid access tokens, bypassing passwords and multifactor authentication. Another intrusion exploited the LiteLLM gateway vulnerability CVE-2026-40217 to elevate an ordinary virtual key into a PROXY_ADMIN master administrator credential.
After access came monetisation at scale. The attackers generated new API keys in bulk and enabled new services, using a 'burn and rotate' method of creating and deleting short-lived service accounts to evade rate limits, while watching the cloud provider's billing console to monitor proceeds. A division of labour has emerged: one side carries out the intrusion, the other operates LLM Mixers that aggregate, meter and resell the stolen quota to underground subscribers.
The emblematic reseller is Jet Night: an unlimited plan at about $60 a month claiming access to frontier models, a tier that at normal market prices should cost $100 to $250 a month. GTIG recorded one attacker using stolen third-party keys to make more than 500,000 large-model API calls in under eight hours in support of Jet Night's service, shifting nearly $1 million in token costs onto victim organisations.
Unlike cryptojacking, which siphons slowly, an LLMjacking bill can spike to its peak within hours. Mandiant's defensive advice is to treat unauthorised enablement of large-model services as a critical security event: in several intrusions, the victim had never enabled the relevant model services at all — the attackers switched them on themselves after obtaining the keys.
WHY IT MATTERSThe bill is the most honest intrusion detector
Traditional intrusion detection watches for malicious code and anomalous logins; LLMjacking is about money. The credentials, tools and gateways the attackers use are all legitimate in form — the only illegitimate part is who the bill belongs to. A $100,000 single-day spike is itself an alarm signal, but only if the company treats its large-model bill as security telemetry rather than a financial statement read at month's end.
This is a direct reminder for every company using large models in the cloud: the exposure of API keys and service account keys is now directly equal to the exposure of the compute budget to theft. Key rotation, least privilege and anomalous-usage alerting — three old chores — carry a new price tag in an era when models are billed by the token.
WHY IT MATTERSAn underground resale market is taking shape
The appearance of services such as Jet Night means stolen quota now has a stable outlet. Attackers no longer need to consume the compute themselves; one intrusion can be sold continuously to subscribers, turning the business model from one-off theft into subscription revenue. That is precisely why GTIG judges LLMjacking will take precedence over traditional resource theft: faster monetisation, higher margins.
The grey zone is trickier. In the same period, Symantec and Carbon Black disclosed another class of relay service that reroutes genuine Codex and Claude Code clients through third-party servers and sells them to markets that cannot use Western AI coding assistants directly. Paying users may not know they are using stolen quota, and the compliance risk spreads from the attackers to end users.
SIGNAL JUDGMENT — ANALYSISThe large-model bill is becoming a new attack surface
Tokenta Signal's judgment: the right way to read this story is to treat API keys as cash. Cryptojacking steals idle compute; LLMjacking steals money priced by the token, and can burn a company's annual AI budget in hours. The defence checklist is short: least-privilege keys, alerts on usage spikes, and treating unauthorised service enablement as a highest-severity event. Checking the logs only after the bill spikes is already $1 million too late.
WHAT REMAINS UNCERTAINWhat Remains Uncertain
EVIDENCEEvidence
The full report on the Google Cloud official blog and The Hacker News report page were both opened and verified directly; core facts including the single-day figure above $100,000, the cumulative $1 million, UNC6993, CVE-2026-40217, Jet Night's roughly $60 plan and the 500,000 calls agree on both sides.
PRIMARY SOURCESPrimary Sources
- Google Cloud Official Blog Report
https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models - The Hacker News Report
https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html
RELATEDRelated Intelligence
- Microsoft Winds Down Its Oracle AI Cloud Rental as Older Nvidia Chips Fall Behind
- An Unreleased Anthropic Model Proved an 18-Year-Old Quantum Conjecture, Machine-Checked in Lean
- IBM Unveils Quantum System Two in Chicago, Its Most Advanced Computer Yet, Powered by Nighthawk
- Vistra Posts $1.14B Q3 Profit as Power EBITDA Jumps Over 50%, Lifts 2026 Outlook