Stolen AI Access Is Now a Resale Business
Cybercriminals have turned reselling cloud access to large language models into a lucrative business, according to reporting on research from Google's Mandiant and Threat Intelligence Group (GTIG) published in early November 2026. The practice, known as LLMjacking, involves stealing cloud credentials and using them to run model inference on the victim's account. In some cases victims paid as much as $1 million in resource consumption before access was revoked.
Key Findings
- Large single-day losses. Individual incidents showed fraudulent charges above $100,000 in a day.
- Common entry points. Exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens. One actor used cloud federation tokens to mint fresh access keys and avoid MFA.
- "LLM Mixers." Attackers pool stolen keys behind illicit proxy gateways and resell unauthorised model access on underground storefronts at deep discounts.
- The "Jet Night" case. One actor made more than 500,000 API calls in under eight hours using stolen third-party keys. Nearly $1 million in token costs landed on the victim organisation, while unlimited access was sold for about $60 a month.
- Marketplace billing abuse. One attacker subscribed to foundation models through AWS Marketplace and billed the inference costs to the victim.
- Gateway abuse. A follow-on cluster used pre-validated virtual keys against a victim's LiteLLM gateway.
Google did not name any victim, cloud provider, or specific model vendor.
Why This Matters
The economics are lopsided. The attacker pays nothing for inference and earns money by reselling it, while the victim receives the bill. Because the abuse looks like ordinary API traffic, it often goes unnoticed until the invoice arrives.
What Defenders Should Do
- Alert on unauthorised enablement of LLM services, such as Amazon Bedrock or the Gemini API, in accounts that do not use them.
- Set budgets and quotas on AI services, with alerts well below what a runaway bill would reach.
- Hunt for exposed credentials. Scan repositories, CI logs, and developer machines for service account keys and personal access tokens, and rotate anything found.
- Shorten credential lifetimes and prefer workload identity over long-lived keys.
- Lock down LLM gateways such as LiteLLM, and rotate virtual keys regularly.
- Restrict marketplace subscriptions so only approved roles can enable model access.