Google's LLMJacking Report Names the Cloud Log Events That Give Attackers Away

An attacker with a stolen cloud key can turn on a model service the victim never used, then resell access to it and leave the victim a bill that passed $100,000 in a single day. That is the pattern Google Threat Intelligence Group (GTIG) and Mandiant describe in a November 2 post on LLMJacking, and the preconditions are modest: one exposed credential and a cloud account where model APIs can be enabled.

The post is credited to nine named GTIG and Mandiant authors, beginning with Christopher Romano and Codi Starks. It gives no incident count, saying only that Mandiant "responded to multiple incidents in 2026" across North America, South America and Asia Pacific, in financial services, retail, technology and transportation.

What the money looks like

Google reports "fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day" and cumulative charges "reaching $1 million USD before access was revoked" at some organizations. One cluster, tracked as UNC6993, ran up more than $100,000 in billing charges. A reseller called Jet Night "passed nearly one million dollars in token costs to the victim organization."

1. Single-day charges, some incidents (exceeded)100K USD
2. Cumulative charges, some organizations (reaching)1M USD

Source: GTIG and Mandiant, Nov. 2, 2026 (figures are stated minimums or maximums as quoted)

The economics on the seller side are cheap. Jet Night's unlimited plan costs about $60 a month, against the "between $100 and $250 per month" the post gives as typical consumer pricing, which GTIG believes only works because the keys are stolen. The service advertised several outages on its public Telegram channel, probably after key revocations.

How attackers get in

The post states no percentages. It calls exposed or stolen cloud identity tokens the dominant vector: IAM credentials, service account keys, GitHub personal access tokens and session tokens. UNC6993 also used a fake application portal that had users paste a raw JSON payload containing an active access token, which skips the password and MFA prompts.

Other routes include public Ollama endpoints, federation tokens used to mint fresh access keys, and corporate LLM API keys "opportunistically harvested" from public GitHub repositories. Validation sweeps use max_tokens=1 requests so the volume stays under EDR and SIEM thresholds.

In several incidents LLM services were off when the attacker arrived. The post says abuse of access keys "allowed the threat actor to modify and enable LLM API services (e.g. Bedrock, Gemini API, etc.)." Its advice is to treat any unauthorized enablement as a critical security event.

Log events to alert on

Cloud	Log source	Calls to watch
AWS	CloudTrail, bedrock.amazonaws.com	ListFoundationModels, PutUseCaseForModelAccess, DeleteModelInvocationLoggingConfiguration
Azure	Activity logs, Microsoft.CognitiveServices	accounts/deployments/write, Microsoft.Insights/diagnosticSettings/delete
Google Cloud	Cloud Audit Logs, aiplatform.googleapis.com	ServiceUsage.EnableService, GenerateContent, ListSinks

On AWS, the post says any call that disables invocation logging from a principal not managed by infrastructure-as-code should be treated as high severity. On Google Cloud, the execution calls such as GenerateContent appear only if Data Access logs are on, and they are disabled by default.

A LiteLLM detail that does not match

The mitigation list tells operators to patch routing gateways, citing CVE-2026-40217 in LiteLLM, which the post describes as a user ID rebind flaw in the /key/regenerate endpoint that lifts a virtual key to PROXY_ADMIN. Obsidian Security's research on the same CVE describes it as a sandbox escape in the custom-code guardrail, with the key and role escalation assigned to CVE-2026-47101 and CVE-2026-47102. The two descriptions cannot both be right for one identifier, so operators should check the LiteLLM advisory rather than the label.

What to do before the bill arrives

The post recommends deny-by-default permissions that exclude cloud LLM services unless needed, phishing-resistant MFA, spending caps, and key scopes limited by model and environment. The Hacker News adds that some relays rewrite the config files of genuine coding CLIs, naming ~/.codex/config.toml and ~/.claude/settings.json, to route traffic through third-party servers.

Fireworks AI attributed its own intrusion to a group of this kind, and the contrast with appliance bugs such as the Ivanti Connect Secure chain is that this class of attack needs a leaked key rather than a vulnerable device. Self-hosted gateways carry their own risk, as the GPUStack authentication bypass showed. GTIG expects attackers to "increasingly prioritize LLMJacking over traditional resource theft like cryptojacking." Google lists jet-night.com and newapi.pro as indicators of compromise.