Google Threat Intelligence Group and Mandiant describe “LLMjacking”: attackers gain access to corporate accounts for large language models and use the services or computing resources without permission.
The report details common access routes, including exposed or stolen identity credentials, and documents cases where charges exceeded $100,000 in a day.
The findings are contained in a report by Google Threat Intelligence Group and Mandiant, published on November 3, 2026 and shared with The Hacker News. The researchers identified incidents in North and South America, as well as the Asia-Pacific region. The organizations affected are in the financial, retail, technology, and transportation sectors.
How do perpetrators gain access?
The most common method is to use leaked or stolen credentials. These include credentials for users with access rights to corporate services, keys used by automated accounts, access keys to GitHub accounts, and credentials that keep a login active. Attackers can find these in source code leaks or exposed application code, exploit misconfigurations, or steal them through deceptive messages.
Google also mentions the UNC6993 group, which allegedly gained access to an artificial intelligence service that generates and processes text. According to the company, the group used an automated account key that was incorrectly configured. It then created additional digital access keys and caused charges of more than $100.000.
Google also says that UNC6993 set up a fake page that posed as an app portal and asked users to paste in an active digital access key. This allowed the attackers to bypass the password and two-step verification.
Resale access
Google describes middlemen who illegally resell access to AI services through underground online stores. One example is Jet Night, which advertises an unlimited plan and claims to offer access to a top model for around $60 a month.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Russian hacker group targets Ukraine with data-stealing programs
↗
Attackers can also use the access to set up their own intermediary services and automated tasks, aiming to make money from the company's services and computing resources.
Separate relay service
In a separate report, Symantec and Carbon Black reported on a service that installs OpenAI’s official Codex and Anthropic’s Claude Code tools. It then configures them to route user requests through third-party systems. The service appears to have been operating since at least early 2026 and has affected about a dozen organizations in mainland China, as well as subsidiaries of multinationals in South Korea, Taiwan, and Malaysia.
Symantec said there is no evidence that the service uses this access to collect what employees type or change the responses they receive.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
