LLMJacking is a tactic where threat actors hijack enterprise access to Large Language Models (LLMs) by exploiting exposed cloud credentials and API keys. This activity has impacted organizations in North America, South America, and Asia Pacific across multiple sectors including financial services, retail, technology, and transportation. Unlike cryptojacking, LLMJacking causes sudden and massive spikes in fraudulent cloud usage charges, sometimes exceeding $100,000 USD daily and accumulating to over $1 million USD. Attackers gain initial access through stolen or exposed cloud identity tokens, IAM credentials, service account keys, and API keys, then escalate privileges and conduct reconnaissance. They monetize compromised resources via LLM Mixers, which are illicit routing gateways that proxy and resell unauthorized LLM access. The threat ecosystem is highly organized with specialized operational clusters coordinating both compromises and monetization infrastructure.