The Rise of LLMjacking: How Attackers Monetize Compromised Cloud and Model Resources

LLMjacking is a tactic where attackers hijack enterprise Large Language Model (LLM) access by exploiting exposed cloud credentials, API keys, and service account tokens. This threat has impacted organizations in financial services, retail, technology, and transportation sectors across North America, South America, and Asia Pacific. Unlike cryptojacking, LLMJacking can rapidly generate fraudulent cloud charges exceeding $100,000 per day, with cumulative costs reaching up to $1 million before access is revoked. Attackers escalate privileges and deploy proxy infrastructure to resell stolen compute capacity through underground marketplaces operated by LLM Mixers, who redistribute unauthorized model access to subscribers.

• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesMalware2026-11-02
• ARTEX abuse expands as cybercriminals target financial sectorMalware2026-11-07
• Black October for AI Developer PlatformsCampaign2026-10-31
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageCampaign2026-10-21