Google: hijacked enterprise LLM access caused fraudulent charges

Exposed cloud tokens gave attackers their initial access

Google said the dominant initial access vector was exposed or stolen cloud identity tokens, including IAM credentials, service-account keys, GitHub personal access tokens and active session tokens. Attackers used those tokens to establish a foothold in target organizations’ infrastructure.

In one mid-2026 case, UNC6993 compromised a cloud instance through a misconfigured service-account key and used access to grant further access to an LLM API. It also hosted a session-hijacking page that masqueraded as an application portal to join a group of LLM users.

The group validated exposed LLM API keys with automated sweeps using minimal single-token requests, with max_tokens=1. Google said the approach let the attackers confirm stolen keys while remaining undetected by endpoint detection and response and security information and event management volume alerts.

Attackers expanded access before monetizing model services

After gaining a foothold, threat actors worked to escalate privileges, solidify access and conduct internal reconnaissance. They searched repositories, logs, databases and secret managers for additional credentials.

Across the intrusions, attackers abused cloud identity permissions and virtual-machine configurations to escalate privileges and maintain persistent access. Google said they created unauthorized accounts, injected SSH keys and generated temporary high-privilege credentials to maintain access and exfiltrate secrets.

UNC6993 attempted to generate additional API keys and enable associated services in victim cloud projects, quickly accumulating more than $100,000 in billing charges.

Google described a division of labor behind LLMjacking

Google identified a division between actors that establish initial access to compromised environments and operators that manage downstream monetization infrastructure, which it called LLM Mixers.

Google said Jet Night offers an unlimited token plan for about $60 per month with alleged access to frontier models, a consumer service level that would typically run between $100 and $250 per month.

Google said defenders should prioritize detection of modifications to LLM accounts and services and treat any unauthorized enablement as a critical security event.