Google Threat Intelligence Group

Headlines · 2

1. 2d
   Mandiant details LLMjacking abuse of stolen cloud credentials

   Mandiant investigated multiple LLMjacking incidents in 2026 in which attackers used stolen cloud credentials and API keys to make unauthorized, high-volume use of enterprise AI services. In one case, an attacker routed stolen API access through Jet Night and made more than 500,000 LLM API calls in under eight hours, leaving the victim organization with nearly US$1 million in usage costs. Other attackers activated services such as Amazon Bedrock and Gemini API inside compromised cloud environments, while some resold access through the illegal proxy operation LLM Mixers.

   iThome 台湾 · 🔥 3
2. 2d
   Google reports LLMjacking attacks targeting stolen AI credentials

   Google Threat Intelligence Group, as reported by TechRadar, says attackers are stealing AI API keys and cloud credentials to run unauthorized AI workloads, establish proxy services and generate large cloud bills for victims. The report describes a growing LLMjacking ecosystem, including credential-pooling gateways known as “LLM Mixers,” while one case involving UNC6993 reportedly accumulated more than $100,000 in charges.

   TechRadar · 🔥 0

Experience and discussion from the community

Share my Google Threat Intelligence Group experienceAsk about Google Threat Intelligence Group