Google Threat Intelligence Group Analyzes LLMJacking Key Theft
Google Threat Intelligence Group and Mandiant published an analysis of LLMJacking, an attack that steals cloud API credentials and resells access to frontier models.
1 source 5d ago
Reporting from 1 source: GameBusiness.jp.
Why it matters
The report puts dollar figures on credential theft: stolen keys resold for about $60 a month ran one victim's model usage bill to roughly $1 million, which makes key scoping and usage limits a billing problem as much as a security one.
Key Facts
- Google Threat Intelligence Group and Mandiant published a blog post analyzing LLMJacking.
- Attackers obtain keys from public GitHub repositories or by hijacking sessions.
- One investigation found unauthorized charges over $100,000 per day before access was stopped, with cumulative damage of $1 million.
- One attacker made more than 500,000 LLM API calls in less than 8 hours.
- Affected organizations are in financial services, retail, technology, and transportation in North America, South America, and the Asia-Pacific region.
Keys are pulled from public GitHub repositories or taken by session hijacking, then pooled into proxy gateways sold on underground marketplaces. Google cites one victim billed more than $100,000 a day before access was stopped, and another attacker who made over 500,000 LLM API calls in under 8 hours.
Attackers also probe Ollama servers left exposed online, sending requests to test whether they can create models without authorization, and use short-lived service accounts created and deleted to dodge rate limits while they watch the cloud billing dashboard. The affected organizations sit in financial services, retail, technology, and transportation across North America, South America, and the Asia-Pacific region. Google's recommended countermeasures are detecting shadow LLMs, setting fine-grained API key permissions, and scanning automatically for sensitive information.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google
Sources
- GameBusiness.jp Googleが「LLMJacking」の手口を分析、盗んだAIの鍵を月60ドルで転売して1日10万ドル超の被害も