Google finds 'LLMjacking' attackers running up $100K a day in fraudulent cloud charges - SiliconANGLE

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

LLMJacking: Hijacking Cloud LLMs and Racking Up $100K in Daily Fraudulent Charges! Over $1M in Damages Uncovered

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.

A coordinated attack wave in October 2026, dubbed

Google e Mandiant alertam para ataques de LLMjacking que exploram credenciais roubadas e geram cobranças de mais de US$ 100 mil por dia.

A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.

Introduction: When Stolen Credentials Become an AI Spending Weapon The rapid expansion of artificial intelligence infrastructure is creating a new opportunity for cybercriminals: stealing cloud credentials and converting them into unauthorized access to expensive AI models. A new investigation published by cybersecurity company Wiz on October 30, 2026, has exposed the financial and operational consequences of this emerging threat. In two separate incidents, attackers reportedly obtained exposed enterprise credentials and used them to generate approximately 800,000 and 1.7 million Amazon Bedrock API calls.

Attackers built an AI agent for LLMjacking that takes over exposed AI models and uses them to steal credentials and mine cryptocurrency.

Utiliser l’IA et laisser une autre entreprise régler la note : c’est le principe du « LLMjacking ». Forgé par l’entreprise de cybersécurité Sysdig en 2024, le terme désigne une pratique déjà documentée. Dans un rapport publié ce 2 novembre 2026, Mandiant, filiale de Google spécialisée dans la cybersécurité, et le Google Threat Intelligence Group (GTIG) illustrent son industrialisation, à travers plusieurs incidents survenus en 2026 dans les secteurs de la finance, des technologies, du commerce et des transports.

Symantec researchers have captured the full playbook of an autonomous LLMjacking agent that hijacks exposed AI models to run its own attacks. Once connected, the agent can scan the internet, break into servers, steal credentials, and mine cryptocurrency. It runs for up to 100,000 steps without human approval, and the model's owner pays for every one. What LLMjacking means LLMjacking is the theft of access to someone else's AI model.

El agente Skynet practica LLMjacking con modelos expuestos: busca servicios de inteligencia artificial sin autenticación, los secuestra y los pone a planear ataques mientras el dueño del servicio paga cada paso. Su modo de trabajo continuo admite hasta 100.000 pasos sin aprobación humana, en un ciclo de rastreo, infección, minería y reinfección de equipos. Symantec publicó el análisis el 21 de octubre y The Register lo retomó este 24 de octubre con declaraciones directas de Priti More, investigadora del equipo Threat Hunter de Symantec. El agente cayó en un señuelo de la propia Symantec durante el verano de 2026: los operadores enviaron sus instrucciones completas creyendo que hablaban con un modelo real, y el señuelo las grabó sin ejecutar ninguna de sus herramientas.

Offensive agent is using unprotected AI models to scan the web, exploit frameworks, steal credentials and mine cryptocurrency for up to 100,000 steps without human input. The model's owner pays for ev...