Google’s Mandiant team published a report on Monday about a racket that has been growing for two years and has now become genuinely expensive: attackers take over a company’s LLM access and burn its compute on its own bill. The industry calls it LLMjacking.
What Google saw
Fraudulent consumption charges can exceed $100,000 a day, according to the report. At some organizations the cumulative total had reached $1 million before anyone revoked the intruders’ access.
An actor Google tracks as UNC6993 obtained LLM API keys, used them to generate more keys, and enabled extra services inside the victim’s cloud projects. Bill: $100,000. A different thief subscribed victim accounts to pay-as-you-go agreements, picked premium foundation models, launched high-volume inference streams, and used a burn-and-rotate strategy of short-lived service accounts to get around rate limits. It also watched the victim’s billing interface to track the financial damage it was causing.
Jet Night sells what somebody else pays for
The most interesting case is a reseller. In under eight hours, more than 500,000 LLM API calls ran through stolen third-party keys to power a token routing service called Jet Night. It sells an unlimited token plan for roughly $60 a month with claimed access to frontier models. Market rate would be $100 to $250. Google concludes the service could not be profitable without stolen keys, and points at Jet Night’s own Telegram channel, where outages are admitted regularly—most likely every time a victim revokes their keys.
The trick with the JSON payload
In a case Mandiant responded to in mid-2026, UNC6993 compromised a cloud instance through a misconfigured service account key and used it to grant itself access to a model API. It also stood up a fake page dressed as an application portal for joining a group of LLM users. The page got people to navigate to the legitimate service website and paste their raw JSON payload containing an active access token. Password and MFA are bypassed without anyone handing over a password.
A division of labour borrowed from ransomware
Google now sees clear role separation: one side establishes initial access to cloud and AI services, the other runs the monetization infrastructure. The term for the latter is LLM Mixers. The analysts expect LLMjacking to overtake older forms of resource theft such as cryptojacking.
The key in the repo is the whole story
Google’s recommendations read as unremarkable: identity and access management, supply chain security, centralized secrets management with rotation, least privilege for users and service accounts, automated secrets scanning across your codebase.
Unremarkable is exactly the point. None of the cases in the report start with a flaw in a model. They start with a key in the wrong place and a service account that could do more than it needed to. What is new is not the attack path but the price. A forgotten key used to cost a few hundred dollars of cloud compute. Today it costs six figures, per day.