Cybercriminals hijack LLM access, racking up bills

Mandiant and the Google Threat Intelligence Group have warned that cybercriminals are hijacking companies' access to large language models, with fraudulent charges exceeding USD $100,000 in a single day in some cases.

The findings draw on incident response work across multiple cloud and LLM providers. Affected organisations were in North America, South America and Asia Pacific, spanning financial services, retail, technology and transportation.

The report describes a pattern in which attackers steal credentials, hijack sessions or use exposed access tokens to enter cloud environments and enable LLM services for their own use. In several incidents, the victim organisation had not previously activated those services.

Once inside, threat actors used the stolen access to run their own operations or sell model access to other attackers. The researchers said this has fuelled an illicit trade in compromised AI access, with stolen keys bundled into proxy gateways they call "LLM Mixers".

These gateways are sold on underground storefronts at sharply reduced prices. In one incident, a token routing service shifted almost USD $1 million in model costs to a victim company while offering customers unlimited access to advanced models for about USD $60 a month.

The financial impact can emerge far faster than in cryptojacking, where resource abuse often builds gradually. In one case, more than 500,000 LLM API calls were made in less than eight hours.

To avoid controls, one attacker used what the report described as a "burn and rotate" method. This involved creating and deleting short-lived service accounts while monitoring the cloud provider's billing interface to measure the cost imposed on the victim.

How attacks start

According to the research, one route into corporate environments has been the theft of valid credentials from public GitHub repositories. Attackers have also relied on broader credential theft and session hijacking to reach cloud systems tied to AI tools and model access.

The report said organisations should treat any unauthorised activation of LLM services as a critical security incident. It also outlined practical steps, including scanning cloud environments for unapproved AI tools, restricting API keys by model and usage, and monitoring code repositories for exposed secrets.

Other recommendations included setting spending caps and model-level quotas, and using phishing-resistant multifactor authentication across identity systems, cloud consoles and developer platforms. The aim is to limit the damage if one access key or account is compromised.

John Hultquist, Chief Analyst at the Google Threat Intelligence Group, said: "Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties. Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks."

He also adds, "Organisations will have to closely monitor and secure the models and compute they are rapidly bringing online or they may not be the only ones using them. That means scrutinizing usage, enabling multifactor authentication, and carefully managing secrets."