Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

Google has warned of a growing threat called LLMjacking, where attackers hijack enterprise access to Large Language Models (LLMs) by stealing API keys or cloud credentials, leading to fraudulent cloud charges reaching up to $1 million. The attacks leverage exposed credentials, misconfigured service accounts, and session tokens to gain unauthorized access, with threat actor UNC6993 identified in multiple intrusions. Attackers escalate privileges, conduct reconnaissance, and abuse cloud identity permissions to maintain persistence and monetize access through illicit proxy services like Jet Night and a grey market relay service repurposing legitimate AI CLIs. These operations bypass regional restrictions and rate limits by reconfiguring CLI tools to route requests through third-party infrastructure, creating a growing underground economy for stolen LLM access.

AI-extracted · verify before operational use