{"slug": "enterprises-pay-100000-a-day-for-ai-they-never-ordered", "title": "Enterprises pay $100,000 a day for AI they never ordered", "summary": "Google Threat Intelligence Group (GTIG) warned that financially motivated \"LLMjacking\" campaigns are hijacking enterprise cloud and LLM credentials and reselling model access through underground subscription services, generating fake cloud charges exceeding $100,000 in a single day and, in some incidents, cumulative charges of $1 million before organizations revoked the compromised access. GTIG based its analysis on multiple incidents in 2026 across cloud and LLM providers in North America, South America and Asia Pacific, including threat actor UNC6993, which used tools such as new-api and gcli2api to aggregate stolen keys, and an operation that used stolen third-party API keys to power the token-routing service Jet Night, which executed more than 500,000 LLM API calls in under eight hours and passed nearly $1 million in token costs to a victim organization. Attackers obtained initial access through exposed or stolen IAM credentials, service account keys, GitHub personal access tokens and active session tokens, and validated stolen keys with single-token requests using max-tokens=1 to stay below consumption-based detection thresholds.", "body_md": "Enterprises deploying large language models (LLMs) in production may be unknowingly footing the bill for someone else’s AI business. Google Threat Intelligence Group (GTIG) is warning of financially motivated [LLMjacking](https://www.csoonline.com/article/3535433/llmjacking-how-attackers-use-stolen-aws-credentials-to-enable-llms-and-rack-up-costs-for-victims.html) campaigns in which cybercriminals hijack enterprise cloud and model access before reselling it through underground subscription services.\n\nThe activity can generate fake cloud charges exceeding $100,000 in a single day, GTIG said in a blog [post](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models). In some incidents, cumulative charges reached $1 million before organizations revoked the compromised access.\n\n“LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” said [Piyush Sharma](https://www.linkedin.com/in/piyushsharrma/), co-founder and CEO at Tuskira. “That puts a lot of weight on the authority attached to each credential. A key issued for one application shouldn’t become a reusable pass to other models and workloads.”\n\nGTIG’s analysis is based on multiple incidents in 2026, spanning a variety of cloud and LLM providers across North America, South America, and Asia Pacific.\n\nGTIG said the monetization infrastructure centers on LLM Mixers, criminal routing gateways that aggregate compromised [API](https://www.csoonline.com/article/4092995/hidden-api-in-comet-ai-browser-raises-security-red-flags-for-enterprises.html) credentials and resell model access to underground subscribers. These services proxy requests across stolen accounts, distribute consumption and hide the original source of access.\n\nMultiple operations were identified using open-source gateways and custom relay infrastructure to pool stolen credentials. One threat actor, UNC6993, used tools including [new-api](https://www.csoonline.com/article/4227199/stolen-ai-credentials-feed-growing-llm-proxy-economy.html?utm=hybrid_search#:~:text=transfer%20stations%20running-,new%2Dapi,-and%20one%2Dapi) and gcli2api to aggregate stolen keys and distribute requests across accounts.\n\nAnother operation used stolen third-party API keys to power Jet Night, a legitimate token-routing service that executed more than 500,000 LLM API calls in under eight hours, GTIG said. The activity passed nearly $1 million in token costs to the victim organization. Jet Night advertises unlimited access to frontier models for approximately $60 a month, substantially lower than the typical cost of comparable legitimate access.\n\nJet Night also experienced occasional outages that GTIG suspects were caused by victims discovering compromises and revoking keys.\n\n“Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important,” said [Nick Tausek](https://www.linkedin.com/in/nicholas-tausek-6ab41611/), lead security automation architect at Swimlane. “By the time someone asks why the cloud bill has exploded, the attacker may already have paying customers.”\n\nInitial access involves exposed or [stolen](https://www.csoonline.com/article/4008240/malicious-pypi-package-targets-chimera-users-to-steal-aws-tokens-ci-cd-secrets.html) cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens, GTIG pointed out. Attackers also harvest LLM API keys from public repositories and scan for exposed model endpoints.\n\nAttackers were seen validating stolen keys with minimal single-token requests, sometimes using max-tokens=1. Such micro-transactions can confirm whether credentials work while remaining below conventional consumption-based detection thresholds.\n\n“Testing a stolen key with a single-token request barely registers as consumption,” Tausek said. “But pair that request with a newly created credential or an unexpected permission change, and there’s something worth investigating.” Analysts shouldn’t have to pull those connections together manually while the attacker gets a head start, he added.\n\nAfter establishing access, attackers enumerate cloud services, repositories, and data stores for additional credentials. They may escalate privileges, create unauthorized service accounts, inject SSH keys, or establish persistence through compromised workloads.\n\nGTIG observed a follow-on threat actor exploiting a user ID rebinding [vulnerability](https://nvd.nist.gov/vuln/detail/cve-2026-40217) in the [LiteLLM](https://www.csoonline.com/article/4149905/pypi-warns-developers-after-litellm-malware-found-stealing-cloud-and-ci-cd-credentials.html) gateway to elevate ordinary virtual keys into administrative credentials.\n\nSharma said organizations must restrict credentials to their intended models, workloads, and endpoints. “The gateway compromise described in these incidents deserves particular attention,” he said, warning that control of the routing layer could open access beyond the original compromised credential.\n\nGTIG recommends tighter credential management, least-privilege permissions, granular API key scopes, monitoring for suspicious low-volume requests, and spending limits on model consumption. It also urges organizations to monitor unauthorized AI service enablement and gateway vulnerabilities.", "url": "https://wpnews.pro/news/enterprises-pay-100000-a-day-for-ai-they-never-ordered", "canonical_source": "https://www.csoonline.com/article/4243863/enterprises-pay-100000-a-day-for-ai-they-never-ordered.html", "published_at": "2026-11-03 11:52:38+00:00", "updated_at": "2026-11-03 12:19:29.836700+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "large-language-models", "ai-policy"], "entities": ["Google Threat Intelligence Group", "UNC6993", "Jet Night", "new-api", "gcli2api", "Piyush Sharma", "Tuskira", "Nick Tausek"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/enterprises-pay-100000-a-day-for-ai-they-never-ordered", "markdown": "https://wpnews.pro/news/enterprises-pay-100000-a-day-for-ai-they-never-ordered.md", "text": "https://wpnews.pro/news/enterprises-pay-100000-a-day-for-ai-they-never-ordered.txt", "jsonld": "https://wpnews.pro/news/enterprises-pay-100000-a-day-for-ai-they-never-ordered.jsonld"}}