Google Threat Intelligence Group exposes surge in LLMJacking cloud attacks

What happened.Google Threat Intelligence Group and Mandiant published security research detailing LLMJacking campaigns where attackers hijack enterprise cloud environments to monetize large language models through underground routing networks.

Why it matters.Enterprise cloud bills scale rapidly with on-demand model inference, creating financial risk that far exceeds traditional cryptomining abuse. When adversaries obtain cloud identity keys, they can run premium language models without deploying persistent malware on host machines. Engineering leaders must enforce strict quota caps and multi-factor authorization on all model enablement APIs. Infrastructure teams must treat unexpected model token validation requests as high-severity security incidents.