The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Google, Monday, November 2nd, 2026
Mandiant reports on LLMJacking attacks in 2026 where hijacked LLM access ran up fraudulent cloud bills of up to $1 million.
Mandiant responded to multiple 2026 incidents in which threat actors hijacked enterprise access to large language models, affecting financial services, retail, technology and transportation organizations in North America, South America and Asia Pacific.
Unlike cryptojacking, LLMJacking can generate fraudulent charges of more than $100,000 in a single day, with cumulative costs at some victims reaching $1 million before access was revoked.
Google Threat Intelligence Group identified financially motivated clusters and a division of labor between initial access actors and operators of LLM Mixers, which proxy and resell unauthorized model access.
Attackers target exposed LLM endpoints or valid API keys, and the post provides detection, hardening and remediation guidance.