{"slug": "google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one", "title": "Google warns: Attacks on corporate AI accounts resulted in over $100.000 in charges in one day", "summary": "Google Threat Intelligence Group and Mandiant reported that attackers are gaining unauthorized access to corporate large language model accounts — a practice dubbed \"LLMjacking\" — and running up charges exceeding $100,000 in a single day. The researchers documented incidents across North and South America and the Asia-Pacific region affecting financial, retail, technology, and transportation organizations, with stolen or leaked credentials as the most common entry point. The report also describes the UNC6993 group, which abused a misconfigured automated account key to mint additional access keys and rack up over $100,000 in charges, and notes underground resellers such as Jet Night offering unlimited access to top models for around $60 a month.", "body_md": "Google Threat Intelligence Group and Mandiant describe “LLMjacking”: attackers gain access to corporate accounts for large language models and use the services or computing resources without permission.\n\nThe report details common access routes, including exposed or stolen identity credentials, and documents cases where charges exceeded $100,000 in a day.\n\nThe findings are contained in a report by Google Threat Intelligence Group and Mandiant, published on November 3, 2026 and shared with The Hacker News. The researchers identified incidents in North and South America, as well as the Asia-Pacific region. The organizations affected are in the financial, retail, technology, and transportation sectors.\n\nThe most common method is to use leaked or stolen credentials. These include credentials for users with access rights to corporate services, keys used by automated accounts, access keys to GitHub accounts, and credentials that keep a login active. Attackers can find these in source code leaks or exposed application code, exploit misconfigurations, or steal them through deceptive messages.\n\nGoogle also mentions the UNC6993 group, which allegedly gained access to an artificial intelligence service that generates and processes text. According to the company, the group used an automated account key that was incorrectly configured. It then created additional digital access keys and caused charges of more than $100.000.\n\nGoogle also says that UNC6993 set up a fake page that posed as an app portal and asked users to paste in an active digital access key. This allowed the attackers to bypass the password and two-step verification.\n\nGoogle describes middlemen who illegally resell access to AI services through underground online stores. One example is Jet Night, which advertises an unlimited plan and claims to offer access to a top model for around $60 a month.\n\n↳\n\nREAD ALSO\n\nHACKS.GR / RELATED\n\nCyber Attacks & Data Breaches\n\nRussian hacker group targets Ukraine with data-stealing programs\n\n↗\n\nAttackers can also use the access to set up their own intermediary services and automated tasks, aiming to make money from the company's services and computing resources.\n\nIn a separate report, Symantec and Carbon Black reported on a service that installs OpenAI’s official Codex and Anthropic’s Claude Code tools. It then configures them to route user requests through third-party systems. The service appears to have been operating since at least early 2026 and has affected about a dozen organizations in mainland China, as well as subsidiaries of multinationals in South Korea, Taiwan, and Malaysia.\n\nSymantec said there is no evidence that the service uses this access to collect what employees type or change the responses they receive.\n\nSet us as a preferred source on Google and find us on social media.\n\nPreferred source\n\nend of article", "url": "https://wpnews.pro/news/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one", "canonical_source": "https://dev.to/hacksgr/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100000-in-charges-in-one-day-3job", "published_at": "2026-11-03 17:17:31+00:00", "updated_at": "2026-11-03 17:25:24.830037+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-infrastructure"], "entities": ["Google Threat Intelligence Group", "Mandiant", "UNC6993", "Jet Night", "Symantec", "Carbon Black", "OpenAI", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one", "markdown": "https://wpnews.pro/news/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one.md", "text": "https://wpnews.pro/news/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one.txt", "jsonld": "https://wpnews.pro/news/google-warns-attacks-on-corporate-ai-accounts-resulted-in-over-100-000-in-in-one.jsonld"}}