The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

What happened?

Written by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.

Key details

• UNC6993 compromised cloud instances via misconfigured Service Account keys and hosted session hijacking pages to steal access tokens.
• Threat actors escalated privileges by exploiting token-creation privileges and creating unauthorized IAM and service accounts.
• Threat actors deployed proxy infrastructure like ai-relay on deceptive domains to siphon commercial LLM access into illicit resale ecosystems.
• GTIG expects LLMJacking will increasingly replace cryptojacking due to higher margins from underground LLM Mixers.

Summarised by SecOraLens from Google Cloud Threat Intel (Mandiant). Always read the original source before acting. How SecOraLens verifies advisories.