Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

Mandiant documents LLMJacking of enterprise model access

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Mandiant says criminals are hijacking corporate LLM access and generating token bills that can exceed $100,000 a day.

Google’s Mandiant documented LLMJacking in 2026: actors hijacked enterprise LLM access through exposed endpoints, stolen API keys, IAM credentials, and session tokens. Victims in financial services, retail, technology, and transportation across North America, South America, and Asia Pacific saw unauthorized API spikes and charges above $100,000 in a day. Google Threat Intelligence says cumulative charges reached $1 million before access was revoked; The Register reports Mandiant said some victims reached about $1 million. Google describes specialized clusters, including UNC6993 and downstream “LLM Mixers,” plus Jet Night, a low-priced token service it believes depends on stolen keys.

Key facts
  • Some organizations saw fraudulent LLM charges above $100,000 in one day.
  • Actors harvested exposed LLM API keys from public GitHub repositories.
  • UNC6993 entered in mid-2026 through a misconfigured service-account key.
  • One intruder made over 500,000 calls in under eight hours.
  • A CrowdStrike case saw about 200,000 API requests in two minutes.
  • Jet Night advertises unlimited tokens for about $60 a month.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Google Threat IntelligenceSectors, regions, GitHub key harvesting, and cumulative $1 million figure.
  • The RegisterUNC6993, Jet Night, call volumes, CrowdStrike case, and fake portal.
Vendors
Google
Products
LLMOllama
Threat actors
UNC6993
Organizations
financial servicesretailtechnologytransportationGoogleMandiantCrowdStrike
Countries
North AmericaSouth AmericaAsia Pacific
AI models
Large Language Models

Coverage

oldest first · one row per article · UTC
  1. · 10h ago Google Threat IntelligenceFirst report

    Threat Actors Use LLMJacking to Monetize Compromised Cloud Models

    Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.

  2. · 8h ago The Register · Security

    Stolen LLM API tokens driving illicit charges above $100,000 a day

    Mandiant says some victims reached about $1 million before cutting access; one intruder made over 500,000 calls in under eight hours.