Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

Summary

LLMjacking turns compromised enterprise cloud identities and LLM API access into attacker-controlled consumption billed to the victim. The article attributes to Google Threat Intelligence Group and Mandiant incidents exceeding $100,000 in fraudulent charges in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked. Reported victims span North America, South America, and Asia Pacific across financial services, retail, technology, and transportation.^[0]

The reported activity is primarily an identity and access-abuse problem rather than exploitation of one software flaw. Exposed or stolen IAM credentials, service-account keys, GitHub Personal Access Tokens, and active session tokens provide entry. Subsequent activity includes credential discovery, privilege expansion, unauthorized account creation, and persistent access. UNC6993 is the named actor: it reportedly used a misconfigured service-account key to reach an LLM API and created additional API keys within victim projects, generating more than $100,000 in charges.^[0]

Monetization extends beyond direct model use. The reporting describes token proxying, model streaming, GPU provisioning, and underground 'LLM Mixers' that aggregate and resell unauthorized access. Jet Night is identified as one such service, advertising an approximately $60 monthly unlimited-token plan. The article describes a division of labor between actors obtaining initial access and operators managing downstream resale infrastructure, but does not establish that Jet Night handled UNC6993's access.^[0]

A separate relay-service report illustrates a related enterprise exposure: genuine Codex and Claude Code installations can be reconfigured to route requests through unauthorized third-party infrastructure while weakening sandboxing and disabling telemetry. This activity should not be conflated with a trojanized client or proven prompt theft; the article reports neither. All substantive findings in this dossier depend on the supplied aggregator article, including its attributed Google and Symantec reporting, rather than independently supplied corroborating source bodies.^[0]

Attack chain

1. 1. Initial access through compromised credentials or session reuse: Across the reported incidents, attackers obtained exposed or stolen cloud identities, repository tokens, LLM API keys, or active sessions. UNC6993 specifically used a misconfigured service-account key to compromise a cloud instance and obtain LLM API access. As another access mechanism, it hosted a purported LLM-user application portal that induced users to submit raw JSON containing an active access token. A separate, unidentified attacker used a stolen repository Personal Access Token before exploiting a suspected application vulnerability in a containerized cloud environment; that case is not attributed to UNC6993.^[0]
2. 2. Post-compromise discovery, privilege expansion, and persistence: After obtaining a foothold, actors enumerated cloud services and identity policies, cloned repositories for hard-coded secrets, searched access logs, and queried databases for further credentials. Reported privilege expansion included service-account token creation and access to cloud secret managers. Persistence included unauthorized IAM and service accounts, SSH-key insertion into compute instances, and accounts disguised as billing-optimization utilities. These are observations across incidents, not a verified sequence of actions by one actor.^[0]
3. 3. LLM resource abuse and monetization: Attackers used the resulting access for token proxying, automated model streaming, GPU provisioning, proxy hosting, and agentic workloads. UNC6993 created additional API keys to scale consumption within victim cloud projects and generated more than $100,000 in charges. Some actors used a 'burn and rotate' approach, repeatedly creating and deleting short-lived service accounts to bypass rate limits. The article separately describes downstream resale through LLM Mixers without tying every monetization service to a specific intrusion.^[0]

Disclosure timeline

Actor profile

UNC6993

The article attributes financially motivated LLM resource hijacking to UNC6993. Its reported activity includes access through a misconfigured service-account key, subsequent LLM API access, and creation of additional API keys within victim cloud projects, producing more than $100,000 in charges. It also operated a session-hijacking portal that solicited raw JSON containing active access tokens under the pretext of joining an LLM-user group. The supplied evidence does not establish the actor's identity, geographic origin, or control of the separately discussed resale and relay services.^[0]

How it works

Session-token capture bypasses the need to repeat the victim's interactive authentication. UNC6993's portal directed users to a legitimate LLM service and persuaded them to copy raw JSON containing an active access token. The captured token was then submitted to the backend API, allowing use of an already authenticated session without completing password and MFA checks. The reported mechanism is session reuse, not a demonstrated cryptographic break of MFA.^[0]

Cloud identity permissions can extend a compromise beyond the initially exposed secret. The article describes attackers using compromised corporate IAM credentials to generate fresh access keys and abusing service-account token-creation privileges to obtain temporary credentials for higher-privilege accounts. Access to cloud secret managers then exposed infrastructure credentials, internal database passwords, and third-party API keys. Repeated creation and deletion of short-lived service accounts also supported rate-limit evasion in some incidents.^[0]

The separate relay service changes the trust boundary through configuration rather than client replacement. After legitimate npm installation of Codex or Claude Code, users were likely instructed to execute a one-line command fetching a fileless PowerShell or bash setup script from vibe.aiok.me. The setup changed ~/.codex/config.toml or ~/.claude/settings.json, redirected requests to relay infrastructure, substituted relay-issued credentials, disabled telemetry and error reporting, and weakened sandbox controls. Codex was specifically configured with 'danger-full-access'; the article also reports network access being enabled for the write sandbox.^[0]

The article names exploitation of LiteLLM CVE-2026-40217 as a privilege-escalation technique observed in the broader LLMjacking activity. It does not supply the vulnerability's technical prerequisites, affected versions, remediation version, or a detailed exploit sequence. The separately mentioned containerized application vulnerability is described only as suspected and is not identified.^[0]

Indicators of Compromise

Key takeaways

• Treat fraudulent LLM consumption as a potential cloud-identity incident, not only a billing anomaly: the reported activity includes credential harvesting, privilege expansion, secret-manager access, and persistence.^[0]
• Separate observed attribution from ecosystem context. UNC6993 has a specific reported intrusion and resource-abuse pattern; Jet Night and the unauthorized coding-assistant relay are not established as infrastructure controlled by that actor.^[0]
• A genuine AI coding client can still operate under an unauthorized and less restrictive configuration. The reported relay demonstrates endpoint redirection and sandbox weakening without a trojanized client, while prompt theft and response manipulation remain unproven in the supplied account.^[0]
• The evidence supports operational detection and identity containment more strongly than version-specific patch guidance. LiteLLM CVE-2026-40217 is mentioned, but affected versions and patch status are not supplied; all substantive reporting remains single-source within this evidence set.^[0]

Defensive actions

• Revoke exposed cloud and LLM credentials and compromised sessions; investigate and remove additional keys or accounts created through the compromised identity.: The reported entry paths include stolen service-account keys, IAM credentials, repository tokens, API keys, and active sessions. UNC6993 created additional API keys after entry, while other actors generated fresh access keys or temporary credentials. Containment should therefore address both the original credential and access subsequently created with it.^[0]
• Review cloud audit records for unexpected key creation, service-account token generation, cross-region enumeration, and access to secret managers, repositories, logs, or credential-bearing databases.: These activities directly match the reported credential-discovery and privilege-expansion techniques. Correlating them with the initially compromised identity can help establish whether apparent LLM billing abuse also involved wider cloud access.^[0]
• Inspect IAM and service-account changes and compute-instance SSH keys for unauthorized persistence, including accounts labeled as billing-optimization utilities.: The article explicitly describes unauthorized accounts, inserted SSH keys, and billing-themed backdoor identities. Revoking a single LLM key would not address those reported persistence mechanisms.^[0]
• Investigate abrupt LLM consumption and billing increases alongside bursts of service-account creation and deletion.: Reported losses exceeded $100,000 in a day, and some actors used short-lived accounts in a 'burn and rotate' strategy to bypass rate limits. Consumption anomalies and identity churn are therefore directly relevant detection leads for this activity.^[0]
• Search public repositories and exposed client-side or environment configuration for enterprise LLM and cloud credentials, and revoke any exposed secrets.: The article identifies source-code leaks, misconfigured environments, exposed client-side code, and public GitHub repositories as routes to unauthorized LLM access. Removing exposed text without revoking the credential would not terminate access already obtained through it.^[0]
• Review Codex and Claude Code configurations for unauthorized relay endpoints, substituted API credentials, disabled telemetry, and weakened sandbox settings; restore approved configurations where these changes are unauthorized.: The reported relay modifies ~/.codex/config.toml and ~/.claude/settings.json rather than replacing the genuine clients. Configuration review is therefore necessary to detect the described redirection, including Codex's 'danger-full-access' setting.^[0]
• Hunt for connections to the two reported service domains and investigate shell or PowerShell execution associated with vibe.aiok.me; restrict unauthorized use according to enterprise policy.: Jet Night is identified as an LLM-access resale service, while vibe.aiok.me served the relay setup scripts. These are distinct investigative leads, not evidence that every connecting endpoint was compromised or that both services share an operator.^[0]
• Warn LLM users against submitting raw session JSON or active access tokens to purported community or application portals.: UNC6993's reported lure specifically sought active tokens under the pretext of joining an LLM-user group, allowing session reuse despite password and MFA controls.^[0]