Written by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial…
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
About this summary. This is a short excerpt from the description that Google Threat Intelligence Group published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
Source attribution: headline and facts are from Google Threat Intelligence Group (cloud.google.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Stolen AI access leaves companies with cloud bills of up to $1 million
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in…
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Uncovering the shadow world of a phishing kit ecosystem Storm-3119: YAM Store, the power broker Storm-2990: The Iron Man System phishing kit Downstream activity from…
NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents
arXiv:2610.11030v1 Announce Type: new Abstract: Tool-using LLM agents violate the policies they are deployed to enforce, often silently. Prior defenses hand-write rules…
KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft
The KeyHunter Operation pairs LLM key theft with an academic fraud campaign that reaches Harvard alumni data, Stanford applications and 18 other universities. SOCRadar’s…
Google: LLMjacking attacks rack up $1 million in cloud AI charges
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per…
CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI observability and testing to its security platform
CrowdStrike announced Monday it has signed agreements to acquire two artificial intelligence security companies, Fiddler AI and Dreadnode, in deals announced at its…