Cybercriminals hijack enterprise LLM access for $100,000 daily charges
Original title: Enterprises pay $100,000 a day for AI they never ordered
GTIG warns of LLMjacking campaigns reselling stolen enterprise model access through underground services, causing fake cloud bills over $100,000 daily.
Cybercriminals hijack enterprise cloud and LLM access to resell model access through underground services. The activity generates fake cloud charges exceeding $100,000 in a single day, with some victims facing cumulative charges up to $1 million. Attackers use tools like new-api and gcli2api to aggregate keys and exploit vulnerabilities such as in the LiteLLM gateway.
Unconfirmed: Exact number of victims and affected providers not disclosed.
- GTIG observed incidents across North America, South America, and Asia Pacific.
- One operation passed nearly $1 million in token costs to a victim.
- Jet Night advertised unlimited frontier model access for $60 a month.
- Attackers validate stolen keys with minimal single-token requests.
Impact: Unauthorized AI model access leading to fake cloud charges up to $1 million.
- 1.Restrict credentials to intended models and workloads
- 2.Monitor for suspicious low-volume AI requests
- 3.Implement spending limits on model consumption
- Vendors
- Threat actors
- UNC6993
- AI models
- LLM models
From the original article
3 min read at csoonline.com
Enterprises deploying large language models (LLMs) in production may be unknowingly footing the bill for someone else’s AI business. Google Threat Intelligence Group (GTIG) is warning of financially motivated LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access before reselling it through underground subscription services.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.