LLMjacking: stolen cloud identities and keys enable managed model services in victim accounts and resell the quota through proxy gateways (GTIG and Mandiant), with control-plane hunting guidance for AWS, Azure and Google Cloud

Mandiant responded to multiple 2026 incidents in which actors hijacked enterprise access to large language models ("LLMJacking") with charges above USD 100,000 in a single day (GTIG, 2026-11-02). The dominant initial access was exposed or stolen cloud identity tokens (IAM credentials, service-account keys, GitHub tokens, session tokens). One actor harvested LLM API keys from public GitHub repositories and validated them with single-token requests that stayed under EDR and SIEM volume alerts; another scripted calls against exposed Ollama endpoints to register its own models; cluster UNC6993 had users paste a raw JSON payload holding an active access token into a fake application-portal page, which bypasses password and MFA (GTIG, 2026-11-02).

After the foothold the actors enumerated cloud services and repositories for credentials, took secrets from cloud secret managers, created unauthorized IAM and service accounts, attached administrative policies to service roles and injected SSH keys into compute instances or instance metadata; one rotated short-lived service accounts to get around rate limits (GTIG, 2026-11-02). In multiple incidents the model services were not enabled at compromise, and the stolen keys were used to enable them and to create further API keys (GTIG, 2026-11-02). A follow-on cluster holding pre-validated virtual keys exploited the victim's LiteLLM gateway at its /key/regenerate endpoint to lift standard virtual keys to proxy-admin credentials (GTIG, 2026-11-02). "LLM Mixers" proxy, aggregate and resell the stolen access; UNC6993 used the open-source new-api and gcli2api gateways (GTIG, 2026-11-02).

Triage: GTIG treats any call that disables model invocation logging, made by a principal outside infrastructure-as-code, as high severity (GTIG, 2026-11-02).