Token thieves costing companies $100K+ per day in illicit LLM charges

Summary

LLMJacking is being used to turn compromised corporate AI access into substantial victim-funded resource consumption. The Register, reporting Mandiant incident-response findings, states that fraudulent charges can exceed $100,000 per day and that cumulative charges at some organizations reached $1 million before intruder access was revoked. The activity described is observed credential and cloud-service abuse, including operations attributed to the named cluster UNC6993.^[0]

The reporting covers several distinct cases rather than one fully connected operation. UNC6993 obtained LLM API keys, generated additional keys, and enabled services in victim cloud projects, incurring $100,000 in one case. A separate actor enrolled victim accounts in Pay-As-You-Go agreements and rotated short-lived service accounts to evade rate limits. In another incident, stolen third-party keys supported more than 500,000 API calls in under eight hours for the Jet Night token-routing service.^[0]

The monetization ecosystem reportedly separates initial-access providers from operators of downstream infrastructure known as LLM Mixers. Access methods include misuse of a misconfigured service-account key and a social-engineering workflow that captures an already authenticated user's active access token. The source's defensive recommendations therefore emphasize identity permissions, secret management and rotation, and removal of credentials from source code.^[0]

Attack chain

1. 1. Obtain LLM API credentials: In the UNC6993 case reported to have incurred $100,000 in charges, the actor illicitly obtained LLM API keys. The article does not specify the acquisition method for that particular case.^[0]
2. 2. Create additional credentials and enable services: After obtaining the keys, UNC6993 generated additional keys and enabled services within the victim's cloud projects.^[0]
3. 3. Consume victim-funded resources: The resulting unauthorized use incurred $100,000 in charges. This amount belongs to the described UNC6993 case and is separate from the broader reporting of daily losses exceeding $100,000 at victim organizations.^[0]

Disclosure timeline

Actor profile

UNC6993

Google's tracking designation for an actor observed abusing cloud and LLM access. The article attributes to UNC6993 a case involving illicitly obtained LLM API keys, additional key generation, service enablement, and $100,000 in charges. It also describes a mid-2026 response involving a misconfigured service-account key used to compromise a cloud instance and obtain further model-API access. The separate Pay-As-You-Go and Jet Night incidents are not attributed to UNC6993 in the supplied account.^[0]

How it works

Service-account credential abuse provided an access path in the mid-2026 UNC6993 incident. A misconfigured service-account key enabled compromise of a cloud instance, after which the actor used that access to grant further access to a model API. The source does not identify a software vulnerability or version-specific exploit for this access path.^[0]

The session-hijacking workflow targeted an existing authenticated session rather than asking the victim to disclose a password. A page posing as an application portal for an LLM-user group instructed users to visit the legitimate LLM service and paste raw JSON containing an active access token. That payload was posted to a backend API, allowing access that bypassed password and MFA controls.^[0]

One monetization workflow used victim accounts to enter Pay-As-You-Go agreements and access premium foundation models. The actor then launched high-volume inference streams, placing the resulting resource-consumption charges on the victim organization.^[0]

The same Pay-As-You-Go case used a 'burn and rotate' strategy: the actor created and deleted short-lived service accounts to bypass rate limits while checking the billing interface to monitor financial impact. The described evasion concerns account-level rate limits, not exploitation of a disclosed software flaw.^[0]

The Jet Night incident illustrates downstream use of stolen credentials: an intruder made more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys to power a token-routing service. Separately, GTIG assessed that Jet Night's economics depended on stolen keys, citing an approximately $60 monthly unlimited-token offering with alleged frontier-model access against a stated typical consumer price of $100–$250. Google characterized stolen-key revocation as a likely explanation for the service's acknowledged outages; that explanation is an assessment rather than a confirmed cause for every outage.^[0]

Key takeaways

• LLMJacking can produce immediate financial impact at cloud-service scale: the reported cases include more than $100,000 in daily fraudulent consumption and cumulative charges reaching $1 million before access revocation.^[0]
• MFA does not prevent misuse of an active access token after a user is persuaded to disclose it. The reported portal workflow captured authenticated session material and used it directly against a backend API.^[0]
• The activity includes distinct operational roles and monetization paths. Initial-access providers, LLM Mixer operators, Pay-As-You-Go abuse, and token-routing services should not be treated as a single attributed operation merely because they all involve LLMJacking.^[0]
• Separate observations from assessments when evaluating reseller services: stolen keys were observed supporting the reported Jet Night incident, whereas the service's overall dependence on stolen keys and the explanation for its outages were presented as Google's assessments.^[0]

Defensive actions

• Revoke compromised LLM and cloud credentials and rotate exposed keys and secrets through centralized secrets management.: The reported incidents depended on stolen API keys or other credentials. Some victims accumulated $1 million in charges before revoking intruder access, and the article specifically recommends centralized secrets management and rotation.^[0]
• Apply least privilege to users and service accounts, limiting permissions to those required for their assigned tasks.: UNC6993 used compromised access to generate additional keys and enable services, while another actor repeatedly created short-lived service accounts. The article explicitly recommends least-privilege access for both users and service accounts.^[0]
• Automate secrets scanning in codebases and remove discovered API keys and other secrets from source code.: The article identifies stolen LLM API keys as an enabler of unauthorized consumption and specifically recommends automated scanning to identify and remove credentials committed to source code.^[0]
• Prioritize identity and access management and supply-chain security in controls protecting cloud LLM services.: This is an explicit recommendation in the source. The reported abuse includes a misconfigured service-account key, unauthorized creation of additional credentials, and capture of active session tokens, making access control central to the described threat.^[0]