# Enterprises pay $100,000 a day for AI they never ordered > Source: > Published: 2026-11-03 11:52:38+00:00 Enterprises deploying large language models (LLMs) in production may be unknowingly footing the bill for someone else’s AI business. Google Threat Intelligence Group (GTIG) is warning of financially motivated [LLMjacking](https://www.csoonline.com/article/3535433/llmjacking-how-attackers-use-stolen-aws-credentials-to-enable-llms-and-rack-up-costs-for-victims.html) campaigns in which cybercriminals hijack enterprise cloud and model access before reselling it through underground subscription services. The activity can generate fake cloud charges exceeding $100,000 in a single day, GTIG said in a blog [post](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models). In some incidents, cumulative charges reached $1 million before organizations revoked the compromised access. “LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” said [Piyush Sharma](https://www.linkedin.com/in/piyushsharrma/), co-founder and CEO at Tuskira. “That puts a lot of weight on the authority attached to each credential. A key issued for one application shouldn’t become a reusable pass to other models and workloads.” GTIG’s analysis is based on multiple incidents in 2026, spanning a variety of cloud and LLM providers across North America, South America, and Asia Pacific. GTIG said the monetization infrastructure centers on LLM Mixers, criminal routing gateways that aggregate compromised [API](https://www.csoonline.com/article/4092995/hidden-api-in-comet-ai-browser-raises-security-red-flags-for-enterprises.html) credentials and resell model access to underground subscribers. These services proxy requests across stolen accounts, distribute consumption and hide the original source of access. Multiple operations were identified using open-source gateways and custom relay infrastructure to pool stolen credentials. One threat actor, UNC6993, used tools including [new-api](https://www.csoonline.com/article/4227199/stolen-ai-credentials-feed-growing-llm-proxy-economy.html?utm=hybrid_search#:~:text=transfer%20stations%20running-,new%2Dapi,-and%20one%2Dapi) and gcli2api to aggregate stolen keys and distribute requests across accounts. Another operation used stolen third-party API keys to power Jet Night, a legitimate token-routing service that executed more than 500,000 LLM API calls in under eight hours, GTIG said. The activity passed nearly $1 million in token costs to the victim organization. Jet Night advertises unlimited access to frontier models for approximately $60 a month, substantially lower than the typical cost of comparable legitimate access. Jet Night also experienced occasional outages that GTIG suspects were caused by victims discovering compromises and revoking keys. “Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important,” said [Nick Tausek](https://www.linkedin.com/in/nicholas-tausek-6ab41611/), lead security automation architect at Swimlane. “By the time someone asks why the cloud bill has exploded, the attacker may already have paying customers.” Initial access involves exposed or [stolen](https://www.csoonline.com/article/4008240/malicious-pypi-package-targets-chimera-users-to-steal-aws-tokens-ci-cd-secrets.html) cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens, GTIG pointed out. Attackers also harvest LLM API keys from public repositories and scan for exposed model endpoints. Attackers were seen validating stolen keys with minimal single-token requests, sometimes using max-tokens=1. Such micro-transactions can confirm whether credentials work while remaining below conventional consumption-based detection thresholds. “Testing a stolen key with a single-token request barely registers as consumption,” Tausek said. “But pair that request with a newly created credential or an unexpected permission change, and there’s something worth investigating.” Analysts shouldn’t have to pull those connections together manually while the attacker gets a head start, he added. After establishing access, attackers enumerate cloud services, repositories, and data stores for additional credentials. They may escalate privileges, create unauthorized service accounts, inject SSH keys, or establish persistence through compromised workloads. GTIG observed a follow-on threat actor exploiting a user ID rebinding [vulnerability](https://nvd.nist.gov/vuln/detail/cve-2026-40217) in the [LiteLLM](https://www.csoonline.com/article/4149905/pypi-warns-developers-after-litellm-malware-found-stealing-cloud-and-ci-cd-credentials.html) gateway to elevate ordinary virtual keys into administrative credentials. Sharma said organizations must restrict credentials to their intended models, workloads, and endpoints. “The gateway compromise described in these incidents deserves particular attention,” he said, warning that control of the routing layer could open access beyond the original compromised credential. GTIG recommends tighter credential management, least-privilege permissions, granular API key scopes, monitoring for suspicious low-volume requests, and spending limits on model consumption. It also urges organizations to monitor unauthorized AI service enablement and gateway vulnerabilities.