The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

Google's Mandiant and threat intelligence group describe 2026 incidents in which attackers hijacked enterprise LLM access, with fraud above $100,000 in a day and up to $1 million at some victims. Stolen cloud identity tokens were the dominant entry point, and one cluster used a LiteLLM gateway flaw (CVE-2026-40217) to gain admin control. Access is resold through "LLM Mixers" such as Jet Night, which Google believes depends on stolen keys. The figures come from Google's own investigations.