---
title: Google/Mandiant: LLMjacking intrusions ran up more than $100,000 a day in model charges and up to $1M per victim, with stolen access resold through 'LLM Mixers' like Jet Night | ctxsec
url: https://ctxsec.com/items/gtig-mandiant-llmjacking-unc6993-llm-mixers-jet-night-100k-per-day
description: "Mandiant responded to several 2026 intrusions in which attackers used stolen cloud identities (IAM keys, service-account keys, GitHub PATs, session tokens) or leaked LLM API keys to switch on managed model services such as Bedrock or the Gemini API, often in accounts that had never enabled them. UNC6993 phished users into pasting raw JSON with live access tokens to bypass MFA. Another actor made more than 500,000 API calls in under eight hours to feed the Jet Night resale service, passing nearly $1M in costs to one victim. One follow-on cluster exploited LiteLLM CVE-2026-40217 (a user-ID rebind in /key/regenerate) to turn virtual keys into PROXY_ADMIN."
status: "official (Google Threat Intelligence Group and Mandiant, Nov 2)"
published: 2026-11-03
---

> Mandiant responded to several 2026 intrusions in which attackers used stolen cloud identities (IAM keys, service-account keys, GitHub PATs, session tokens) or leaked LLM API keys to switch on managed model services such as Bedrock or the Gemini API, often in accounts that had never enabled them. UNC6993 phished users into pasting raw JSON with live access tokens to bypass MFA. Another actor made more than 500,000 API calls in under eight hours to feed the Jet Night resale service, passing nearly $1M in costs to one victim. One follow-on cluster exploited LiteLLM CVE-2026-40217 (a user-ID rebind in /key/regenerate) to turn virtual keys into PROXY_ADMIN.

[← AI](/ai) · [markdown](/items/gtig-mandiant-llmjacking-unc6993-llm-mixers-jet-night-100k-per-day.md)

official (Google Threat Intelligence Group and Mandiant, Nov 2)

2026-11-03

### Google/Mandiant: LLMjacking intrusions ran up more than $100,000 a day in model charges and up to $1M per victim, with stolen access resold through 'LLM Mixers' like Jet Night

- **Validation sweeps:** stolen keys were checked with single-token requests (`max_tokens=1`) that stay under volume alerts; watch gateway logs for these.
- **Persistence:** backdoor service accounts named like billing-optimization tools, SSH keys injected into instance metadata, "burn and rotate" short-lived service accounts to dodge rate limits, a Manus-based agent backdoor and GPU quota requests across regions.
- **AWS:** CloudTrail for `bedrock.amazonaws.com`: `InvokeModel`, `InvokeModelWithResponseStream`, `Converse`; recon via `ListFoundationModels`, `GetFoundationModelAvailability`; unlocks via `PutUseCaseForModelAccess`, `CreateFoundationModelAgreement`; treat `DeleteModelInvocationLoggingConfiguration` by a non-IaC principal as high severity.
- **GCP:** alert on `ServiceUsage.EnableService` for aiplatform; enable Data Access logs to see `PredictionService.GenerateContent`/`StreamGenerateContent`.
- **Azure:** `Microsoft.CognitiveServices/accounts/deployments/write` and diagnostic-settings changes.
- **Network IoCs:** jet-night[.]com, newapi[.]pro.

**Cheapest fixes:** deny model-service permissions to identities that don't need them, set hard budgets and per-model quotas, scope API keys to specific models and environments, and patch LiteLLM and other model gateways like any internet-facing app.

Sources: [Google Cloud Threat Intelligence: The Rise of LLMJacking (Nov 2)](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/) · [The Hacker News: Google warns LLMjacking attacks are costing some enterprises up to $1 million](https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html)