LLMjacking Hits Firms With $100K-a-Day AI Bills

Google Threat Intelligence Group warns of financially motivated LLMjacking campaigns that steal enterprise cloud and model credentials and resell access via underground subscriptions. Fake cloud charges can exceed $100,000 a day, and some incidents reached $1 million cumulatively before access was revoked. The infrastructure, called LLM Mixers, spans multiple cloud and LLM providers across North America, South America and Asia Pacific.

• Hackers hijack AI accounts and servers to fuel cybercrime2026-09-27