GoogleAnalysisGoogle Threat Intelligence Group exposes surge in LLMJacking cloud attacks
What happened.Google Threat Intelligence Group and Mandiant published security research detailing LLMJacking campaigns where attackers hijack enterprise cloud environments to monetize large language models through underground routing networks.
Why it matters.Enterprise cloud bills scale rapidly with on-demand model inference, creating financial risk that far exceeds traditional cryptomining abuse. When adversaries obtain cloud identity keys, they can run premium language models without deploying persistent malware on host machines. Engineering leaders must enforce strict quota caps and multi-factor authorization on all model enablement APIs. Infrastructure teams must treat unexpected model token validation requests as high-severity security incidents.
The technical specifications:
- Financial impact: Attackers run up unauthorized cloud bills exceeding $100,000 in a single day by exploiting stolen credentials, generating aggregate enterprise damages approaching $1 million before access revocation.
- Underground monetization: A specialized cybercrime economy proxies stolen inference bandwidth through illicit routing services known as LLM Mixers, reselling enterprise model capacity to third-party subscribers at deep discounts.
- Infiltration mechanics: Threat actors gain initial access through leaked service account keys, exposed GitHub tokens, and insecure cloud endpoints, often enabling dormant model APIs on victim accounts.