The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Written by: Christopher Romano, Codi Starks, John Wolfram, Josh Murchie, Mathew Potaczek, Garrett Mahoney, Mike Lombardi, K Singh, Rik Dolfing
Introduction
Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.
Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours. Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.
Figure 1: Usage chart showing LLMJacking generating a spike in API requests
Analyzing the criminal ecosystem behind these frontline compromises, and building...
Copyright of this story solely belongs to cloud.google.com. To see the full text click HERE
