Intruders who breach corporate cloud accounts are quietly activating dormant artificial intelligence tools and running models at company expense, running up bills exceeding 100,000 dollars in a day.
Investigations carried out across 2026 by Mandiant and the Google Threat Intelligence Group revealed intrusions across Asia Pacific, North America and South America that reached cumulative costs of up to 1 million dollars before victims spotted the leaks. The compromises struck retail, transportation, financial services and technology companies that had adopted large language model architectures into their systems.
How Illicit Resellers Drain Foundation Models
The campaign, dubbed LLMJacking, relies on a distinct commercial division of labour within cybercrime rings. One group specializes in penetrating corporate environments to harvest credentials, while a separate tier operates illicit platforms known as LLM Mixers to resell that raw model compute to third-party subscribers.
One service, trading under the name Jet Night, offered paying customers unlimited subscriptions for about 60 dollars a month to access premium foundation models. Comparable commercial access carries legitimate pricing between 100 and 250 dollars. Security investigators determined the syndicate could only sustain that price differential by powering the backend with stolen enterprise credentials.
During a single intrusion linked to the network, an unauthorized actor channeled more than 500,000 queries to foundation models in under eight hours. The targeted enterprise absorbed an unauthorized token bill approaching 1 million dollars before discovering the drain. Jet Night subsequently recorded sudden outages on its Telegram broadcast channels whenever compromised businesses identified the breach and revoked the active keys.
Another unauthorized syndicate set up a lookalike domain disguised as an internal corporate host, routing the victim organization’s application programming interface quotas into a commercial resale front operating as newapi.pro.
The Shift From Cryptojacking to Token Hijacking
Retailers and consumer tech operators have spent years guarding compute fleets against illicit cryptocurrency mining, but model hijacking works at vastly accelerated speed. Cryptojacking trickles away compute slowly to evade system detection, whereas LLMJacking generates massive spikes in fraudulent cloud charges in a matter of hours.
Investigators noted that actors reach their goals through token proxying, automated model streaming and unauthorized graphics processing unit hardware provisioning. Rather than manipulating consumer-facing chatbots to spit out rogue lines of code, the attackers bypass the store front-end entirely to tap backend infrastructure.
For retail and digital commerce platforms in Asia that connect real-time product search, automated customer query desks and dynamic inventory to foundation models, the financial exposure sits directly in the operating budget. Cloud quotas linked to corporate credit accounts or open enterprise billing agreements allow perpetrators to cash out instantly through black-market resale while the operator absorbs the invoice.
Stolen Keys and Exposed Gateways
Initial penetration rarely requires novel zero-day attacks. Threat groups scrape publicly exposed GitHub repositories for stray application programming interface keys, running minute test queries designed to avoid triggering usage alerts.
Most intrusions stem from compromised cloud infrastructure credentials, including unprotected service account keys, active session tokens and corporate GitHub authorization tokens. A group tracked as UNC6993 gained access to a commercial cloud instance via a misconfigured service account credential, quickly bridging across into internal model endpoints. The same operators established a fraudulent registration portal for model developers, tricking visiting engineers into submitting live access tokens that circumvented multi-factor authentication controls.
Once inside a corporate network, attackers search database tables and data warehouse systems for deeper administrative secrets, occasionally disguising backdoor accounts as internal cost-optimization utilities. In another instance, attackers targeted a vulnerability logged as CVE-2026-40217 inside a LiteLLM routing gateway, escalating basic user credentials into root administrative control.
Dormant Services Turned on by Intruders
In multiple forensic investigations conducted by Mandiant, the targeted companies had left their high-tier machine learning services deactivated. Intruders used administrative cloud credentials to switch on the dormant model engines, initiating high-frequency automated requests within minutes.
The findings indicate that monitoring routine endpoint activity is no longer sufficient for digital commerce operators running hybrid cloud stacks. IT departments now face the operational reality that unmonitored API limits directly threaten gross margins, turning routine cloud administration into an immediate balance-sheet liability.
Enterprises running production workflows across multiple public cloud providers must track anomalous model activation alerts and enforce hard spend caps on machine learning billing accounts to catch breaches before usage tallies reach six figures.
