Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
Summary: Google's Threat Intelligence Group and Mandiant reported that attackers are hijacking enterprise LLM access by obtaining API keys through phishing, source code leaks, misconfigured environments, or exposed client-side code, leaving the legitimate owner to pay the consumption costs. Fraudulent charges exceeded $100,000 in a single day in individual incidents, with cumulative charges at some organizations reaching $1 million before access was revoked, across financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific.
Bottom line: A stolen API key can run up $100,000 in cloud charges in a single day, and some organizations reached $1 million before the access was cut off - a bill that arrives without any malware on your endpoints. Google also expects threat actors to prioritize LLMjacking over cryptojacking as underground LLM Mixers like Jet Night resell stolen capacity at roughly $60 per month.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026