Stolen LLM API tokens driving illicit charges above $100,000 a day
Mandiant says some victims reached about $1 million before cutting access; one intruder made over 500,000 calls in under eight hours.
74
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 2, 2026
- Last mentioned8h ago
Timeline
2 articles · newest firstThreat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
75
Appears with
- transportationorganization · 1
- Mandiantorganization · 1
- Ollamaproduct · 1
- CrowdStrikeorganization · 1
- financial servicesorganization · 1
- Googleorganization · 1
- retailorganization · 1
- Googlevendor · 1
- Large Language Modelsai model · 1
- technologyorganization · 1
- LLMproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.