The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

* Threat actors hijacked enterprise access to Large Language Models (LLMs) via "LLMJacking."
* Fraudulent charges associated with resource consumption exceeded $100,000 USD in a single day across individual incidents.
* Cumulative charges reached $1 million USD before access revocation in some organizations.
* Initial access often involved stolen cloud identity tokens, including IAM credentials, Service Account keys, and session tokens.
* Threat actors tested publicly exposed LLM endpoints by calling endpoints to run their own models.
* Attackers exploited a compromised Service Account key to grant further LLM API access.
* Credential harvesting included stealing LLM API keys from public GitHub repositories.
* Threat actors used automated scripts to validate stolen keys using minimal requests (e.g., maxtokens=1).
* Threat actors leveraged vulnerabilities in LLM routing software, such as a user ID rebind vulnerability in the /key/regenerate endpoint (CVE-2026-40217), for privilege escalation.
* Monetization involved proxying access and selling stolen quotas through "LLM Mixers."
* Attackers deployed custom proxy relay infrastructure to siphon commercial LLM access into illicit resale ecosystems.

The narrative of LLMJacking reveals a maturation of cybercrime where the focus has shifted from simple resource theft, like cryptojacking, to the high-margin monetization of advanced AI resources. The division of labor between initial access and "LLM Mixers" indicates a specialized market is forming, suggesting that threat actors are developing sophisticated operational playbooks tailored to the specific architecture of cloud-based LLMs. The observation that attackers target specific middleware vulnerabilities, like those in LiteLLM, points toward an evolving supply chain risk where the software facilitating model access becomes a prime vector for privilege escalation rather than just the underlying cloud infrastructure. The monetization through services like Jet Night demonstrates a sophisticated business model leveraging stolen quotas and high-demand frontier models, which moves the crime beyond simple data exfiltration into direct service arbitrage. This implies that as enterprises increasingly rely on integrated LLM workflows, the security burden shifts to securing the complex orchestration layers—the routing gateways and agentic frameworks—as much as the foundational cloud credentials. The critical implication is that detection must move beyond monitoring raw resource usage to focus on the behavioral patterns within API calls, especially low-volume validation sweeps, and the integrity of the model routing layer itself.
Bridge Questions: If defense focuses heavily on hardening infrastructure permissions and endpoint security, what specific architectural controls are most effective at mitigating risks originating from compromised LLM routing software? How can organizations establish real-time visibility into the intent behind complex API calls to distinguish legitimate high-volume usage from automated token validation sweeps? What systemic changes are necessary to prevent the creation of specialized resale markets that profit directly from enterprise infrastructure compromises?