LLMJacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals are reselling cloud access to LLMs, costing victims up to $1M.
A new criminal enterprise, dubbed 'LLMJacking', has emerged where threat actors gain unauthorized access to cloud-based Large Language Models (LLMs) and then resell this access to other malicious actors. Victims have reported significant financial losses, with some incurring costs up to $1 million in cloud resource consumption before their access was revoked.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonLLMJacking occurs when threat actors steal valid cloud credentials or API keys granting access to expensive Large Language Model services, then resell that access to other criminals while the victim foots the bill. The root cause is weak access control over cloud-based AI resources — credentials are over-privileged, poorly rotated, or exposed through misconfigured environments. Victims only discover the breach after catastrophic billing spikes, revealing a critical gap in real-time monitoring and anomaly detection for cloud resource consumption. This matters because the financial damage can reach seven figures before any response is triggered, and the stolen access enables downstream criminal activity including AI-generated phishing, malware, and disinformation at scale.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.