A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency.

Federal prosecutors charged two Canadian men with breaching university networks across four states to illicitly mine cryptocurrency and harvest credentials.

Introduction: As artificial intelligence models become central to corporate infrastructure, cybercriminals are shifting tactics from traditional cryptojacking to "LLMjacking"—stealing API credentials from public repositories and codebases to run up astronomical cloud computing bills. Beyond credential theft, unauthenticated remote code execution (RCE) flaws in orchestration tools like Langflow and shadow sales integrations are exposing sensitive business environments. Establishing rigorous access controls, real-time rate monitoring, and rapid patch management is essential to safeguard modern enterprise AI deployments.

Canada extradited one of two nationals charged in the U.S. over alleged hacks of university networks and supercomputers. The indictment alleges credential…

Claude Code localiza un minero XMRig en un Mac tras analizar lecturas térmicas críticas. Claves del cryptojacking y la seguridad en macOS.

Sigue de la cobertura del 24/10, donde Symantec documentó un agente de LLMjacking corriendo hasta 100.000 pasos sin pedir permiso: ahora el Google Threat Intelligence Group y Mandiant ponen los números y el modelo de negocio. La diferencia con el cryptojacking clásico es la velocidad —"puede…

Google Threat Intelligence Group y Mandiant Services alertan sobre el LLMJacking, una táctica en la que actores maliciosos comprometen credenciales corporativas en la nube para secuestrar el acceso a modelos de lenguaje avanzados (LLM) y revenderlo. A diferencia del cryptojacking, genera picos de consumo con facturas fraudulentas que pueden superar los 100 mil dólares diarios por organización.

Google Threat Intelligence Group y Mandiant Services alertan sobre el LLMJacking, una táctica en la que actores maliciosos comprometen credenciales corporativas en la nube para secuestrar el acceso a modelos de lenguaje avanzados (LLM) y revenderlo. A diferencia del cryptojacking, genera picos de consumo con facturas fraudulentas que pueden superar los 100 mil dólares diarios por organización.

Written by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic kno

This technical analysis details a sophisticated Android malware campaign targeting the Indian banking sector. The report examines seven distinct trojan families that facilitate banking fraud through coordinated phishing, credential theft, and unauthorized cryptojacking. Group-IB provides an in-depth breakdown of the attack chain, malware capabilities, and the infrastructure used to compromise mobile devices.

Symantec researchers have captured the full playbook of an autonomous LLMjacking agent that hijacks exposed AI models to run its own attacks. Once connected, the agent can scan the internet, break into servers, steal credentials, and mine cryptocurrency. It runs for up to 100,000 steps without human approval, and the model's owner pays for every one. What LLMjacking means LLMjacking is the theft of access to someone else's AI model.

Introduction: Cloud resource hijacking has evolved into a lucrative vector for threat actors seeking unallocated compute power for malicious cryptocurrency mining. By exploiting container escape vulnerabilities and deploying browser-based WebAssembly scripts, adversaries silently consume enterprise resources while bypassing traditional perimeter security. Mitigating these risks requires transitioning from reactive log inspection to continuous runtime telemetry and Cloud Security Posture Management (CSPM).