Google Details Criminal Enterprise Reselling Stolen LLM Access

Cybercriminals have established a thriving business model around stealing access to commercial LLMs and reselling it, with victims incurring resource costs up to around $1 million before access is revoked. The practice, termed LLMjacking, has shifted from isolated incidents to an underground enterprise, according to a Google Threat Intelligence Group (GTIG) and Mandiant report published on 3 November 2026.

GTIG notes that fraudulent cloud-era charges can spike to six figures in a single day, highlighting the scale of the monetisation potential for attackers.

Google researchers describe how initial access is gained and persistence established, with the dominant vectors being exposed or stolen cloud identities — including IAM credentials, service-account keys, GitHub personal access tokens, and active session tokens.

The report also details techniques such as minimal API requests to quietly validate stolen credentials and avoid triggering large consumption, as well as various attack paths like misconfigured service accounts, session hijacking pages designed to phish tokens, stolen PATs used to breach private code repositories, and compromised cloud federation tokens enabling MFA bypass.

A key element in monetising the theft is the LLM Mixer, underground services that aggregate stolen credentials and route requests through victim environments to offer access to premium models below legitimate prices. GTIG emphasises the need for rapid detection of compromised identities, unauthorised permissions, and suspicious access to AI services to limit costly resource usage.