-10.png?w=1024)
Stolen enterprise AI credentials are fueling an underground market where cybercriminals resell access to premium AI models while leaving legitimate account owners with the bills.
Researchers from Google Threat Intelligence Group (GTIG) and Mandiant have identified services known as LLM Mixers that pool compromised API credentials and route AI requests through victims' accounts. These operations allow paying customers to access expensive AI models without obtaining their own legitimate subscriptions.
According to Google's investigation, some organizations have faced more than $100,000 in unauthorized AI charges in a single day, with reported costs reaching as much as $1 million in certain cases before the attackers were removed.
The findings suggest that hijacking AI tokens is developing beyond opportunistic credential theft into a criminal business model for malicious actors.
How attackers turn stolen AI credentials into a business
The technique, known as LLMjacking, has affected organizations across North America, South America, and Asia-Pacific, according to Google.
Instead of breaking into AI models, criminals target the credentials businesses use to access them. These may include API keys exposed in public code repositories or credentials obtained through compromised accounts.
Once attackers gain access, they can send requests to commercial AI models through the victim's account, generating usage charges that the legitimate owner may not immediately notice.
Some operators have gone further by creating LLM Mixers, services that combine access from multiple compromised accounts and resell it to paying customers.
One example cited in the investigation is Jet Night, which advertised unlimited AI access for approximately $60 per month.
The result is a criminal business model in which attackers monetize stolen credentials while transferring the cost of AI usage to the organizations whose accounts have been compromised.
What eWEEK found: Stolen AI access creates a new kind of financial exposure
Google's findings reveal a distinction between conventional credential theft and LLMjacking: attackers can turn stolen AI access into a recurring source of revenue without necessarily stealing data or disrupting the victim's systems. Every unauthorized request consumes resources billed to the compromised account, allowing costs to accumulate while the service continues operating.
The emergence of LLM Mixers adds another layer to the threat. Instead of using stolen credentials themselves, operators can pool access from multiple compromised accounts and resell it to customers. This separates the people stealing credentials from those consuming the AI services, potentially making unauthorized activity harder for account owners to recognize.
Security concern | Conventional account compromise | LLMjacking-specific activity |
|---|---|---|
| Primary target | User accounts, credentials, systems, or data | Cloud credentials, AI API keys, or exposed model endpoints |
| Criminal benefit | Unauthorized access, data theft, or resource abuse | Unauthorized AI consumption and resale of model access |
| Business impact | Data exposure, disruption, or infrastructure costs | Fraudulent AI charges, potentially alongside data theft or broader cloud compromise |
| Detection challenge | Identifying unauthorized access and suspicious account activity | Detecting abnormal model requests, credential misuse, and unexpected AI spending |
The comparison highlights a gap in how enterprises may approach AI security. Traditional identity controls remain essential, but valid API credentials can allow unauthorized requests to resemble ordinary application traffic. Monitoring access alone may therefore be insufficient without visibility into usage patterns and spending.
The findings do not establish that criminals are using compromised AI accounts to conduct attacks against the same organizations paying for those resources. They do, however, demonstrate a business model in which stolen credentials can be monetized repeatedly, turning AI consumption itself into a security and financial risk.
What businesses should take away
The rise of LLMjacking does not necessarily point to a new class of security weaknesses. It shows how attackers are applying familiar tactics, such as credential theft and account compromise, to a new target: enterprise AI services. As businesses adopt more AI tools, they also create more accounts, API keys, and connections that attackers can exploit if they aren't properly protected.
That makes basic cybersecurity practices just as relevant to AI adoption. Businesses should restrict who and what can access their AI services, keep API keys out of public code repositories, protect employee accounts with multifactor authentication, and regularly review access permissions.
They should also monitor AI usage and billing for unusual spikes, set spending limits where available, and revoke credentials immediately when they suspect compromise.
But securing access is only part of the job. AI adoption also means understanding where these tools are connected to company systems, what information they can access, and how much they are allowed to consume. An AI tool with permission to access company data or perform tasks can become a serious liability if its account or credentials fall into the wrong hands.
For enterprises adopting AI, the lesson is that API credentials should be treated with the same care as other sensitive cloud access keys. A compromised account can expose more than company data or computing resources; it can also generate substantial charges before security teams recognize that something is wrong.
As AI services become more deeply embedded in business operations, organizations will need to monitor not only who can access their models, but also how those models are being used and how much that usage costs.
In other AI security news, Anthropic reported that an unreleased Claude model built five working exploit chains targeting Chrome, Safari, Android, Windows, and Linux, demonstrating how AI can combine software vulnerabilities into attacks capable of bypassing security protections, accessing sensitive data, and compromising systems.