Google GTIG and Mandiant: stolen cloud access ran up $100,000 in a day, UNC6993 phished live tokens past MFA, and Jet Night resold access for about $60 a month.
Google Threat Intelligence Group (GTIG) and Mandiant published casework on 3 November 2026 showing that LLMjacking, the abuse of stolen cloud credentials to run AI models on someone else's bill, now causes six-figure daily losses. In individual 2026 incidents, fraudulent charges passed $100,000 in a single day. At some organisations the cumulative bill reached $1 million before access was revoked. Any organisation with cloud identities that can enable or call hosted models (Bedrock, Azure AI, Vertex AI or the Gemini API) is exposed, as is anyone running a LiteLLM gateway.
UNC6993: a service-account key, then a fake portal
GTIG tracks one cluster as UNC6993. In mid-2026 it compromised a cloud instance through a misconfigured service-account key and used that foothold to reach an LLM API. It then tried to create more API keys and enable related services in victim projects, accumulating more than $100,000 in charges.
A second technique targeted people. UNC6993 hosted a page disguised as an application portal for joining a group of LLM users. Victims were told to open the legitimate LLM service in their browser and paste a raw JSON payload containing a live access token, which the page posted to the attacker's backend. A live token is already past authentication, so the theft bypasses both password and MFA. For aggregating and load-balancing stolen keys the actor used the open-source tools new-api and gcli2api.
Other initial access routes in the report: exposed or stolen cloud identity tokens (IAM credentials, service-account keys, GitHub personal access tokens, session tokens), which GTIG calls the dominant vector; publicly exposed LLM endpoints such as Ollama /api/create; LLM keys harvested from public GitHub repositories; and federation tokens used to mint fresh access keys.
LiteLLM escalation and a CVE discrepancy
GTIG says a follow-on cluster used pre-validated LiteLLM virtual keys obtained from the initial-access actor against a victim's LiteLLM gateway, and names CVE-2026-40217 as the flaw, describing it as a user ID rebind in /key/regenerate that raises a standard virtual key to PROXY_ADMIN.
The public records do not match that description. NVD (published 10 April 2026, CVSS 3.1 base score 8.8 High, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, shown as a secondary score from cve@mitre.org) describes CVE-2026-40217 as remote code execution through bytecode rewriting at /guardrails/test_custom_code. The GitHub advisory GHSA-wxxx-gvqv-xp7p calls it a sandbox escape in the custom-code guardrail, reachable with a proxy-admin credential in default configurations. It lists versions from 1.81.8 up to but not including 1.83.10 as affected and 1.83.10 as the first patched release (the advisory text says 1.83.11). Neither record mentions /key/regenerate. Separately, The Hacker News reported in June that LiteLLM flaws CVE-2026-47101 (unchecked allowed_routes on key generation) and CVE-2026-47102 (/user/update accepting a self-set proxy_admin role) can be chained with CVE-2026-40217, with the full fix set in v1.83.14-stable. Until GTIG clarifies, treat the key-regeneration attribution as unconfirmed and patch to 1.83.14-stable or later, which covers all three.
Jet Night and the resale market
Jet Night (jet-night.com) is an "LLM Mixer" token-routing service. It sells an unlimited plan at about $60 a month with claimed frontier-model access, against $100 to $250 a month for comparable consumer tiers. GTIG believes the price only works on stolen keys, and notes Jet Night advertised repeated outages on its Telegram channel, likely when victims revoked compromised keys. One actor ran more than 500,000 API calls in under eight hours through the service, passing nearly $1 million in token costs to a single victim. A related ecosystem uses custom "ai-relay" infrastructure on lookalike domains feeding newapi[.]pro, and a persona called D1337-KAIROS ran rebranded multi-LLM proxies and requested GPUs and quota increases.
Attackers tested stolen keys with max_tokens=1 requests, which stay under volume-based alerts, and repeatedly created and deleted short-lived service accounts to dodge rate limits while watching the billing.
Where to look in each cloud, per Google GTIG and Mandiant.
What defenders should do
Mandiant treats unauthorised enablement of an LLM service as a critical security event: in several incidents the service was disabled at compromise, then switched on with abused keys, producing large bills within minutes or hours.
Detection, per the report:
- AWS CloudTrail (
bedrock.amazonaws.com):InvokeModel,InvokeModelWithResponseStream,Converse; recon callsListFoundationModels,ListInferenceProfiles,GetFoundationModelAvailability; unlocking callsPutUseCaseForModelAccess,CreateFoundationModelAgreement; logging changes by non-IaC principals. - Azure:
Microsoft.CognitiveServices/accounts/deployments/write, completions volume in diagnostic logs (which must be enabled), and diagnostic-setting changes. - GCP:
aiplatform.googleapis.comcalls andServiceUsage.EnableService. Data Access logs are off by default and must be enabled.
Mitigations Mandiant recommends include: centralised secrets management with automated rotation; least privilege that denies LLM services unless required; secret scanning across code hosts; periodic configuration audits; WAF rate limiting; outbound allow-listing; per-model quotas, spending caps and budget alerts; phishing-resistant MFA; discovery of shadow LLM infrastructure; API keys segmented by model, environment and usage limit; alerts on low-volume probes such as max_tokens=1; patching ML dependencies; sandboxing generated code; pulling models only from vetted registries; including LLM gateways such as LiteLLM in patch programmes; and graph-based exposure modelling and adversarial exposure validation.
Related ThreatFrontier coverage: the Skynet LLMjacking agent caught in a Symantec honeypot and the PoeLLM botnet that turns exposed LiteLLM and Ollama servers into miners.