The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

Mandiant reports on multiple 2026 incidents where threat actors executed 'LLMJacking,' a tactic involving the hijacking of enterprise access to large language models to generate massive fraudulent cloud and API charges. Attackers leverage exposed cloud identity tokens and API keys, sometimes funneling unauthorized access through illicit underground intermediaries known as 'LLM Mixers' to monetize stolen compute resources. Google Threat Intelligence Group outlines these attack lifecycles, along with detection strategies, hardening techniques, and mitigation guidance for cloud defenders. Open article →