Google Warns of LLMJacking Attacks Generating Over $100,000 Daily
Attackers hijack enterprise LLM access to run up massive fraudulent charges before access is revoked.
80
Victim
financial services
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenSep 24, 2026
- Last mentioned7d ago
Timeline
2 articles · newest firstBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
Related CVEs
by mentions- CVE-2026-4021717%8.8LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI
Appears with
- government agenciesvictim · 1
- and transportation organizationsvictim · 1
- Storm-2570ai model · 1
- Anubismalware · 1
- information technology (IT)victim · 1
- Gemini APIproduct · 1
- retailvictim · 1
- commercial facilitiesvictim · 1
- healthcarevictim · 1
- financial servicesorganization · 1
- BERTmalware · 1
- energyorganization · 1
- ransomware affiliateproduct · 1
- government agenciesorganization · 1
- consumer retailorganization · 1
- Bedrockproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.