Shutting the Door on the XCPE Botnet
cloud.google.com·22h ago
Cloud & Infrastructure
Google Cloud Blog·22h ago·5 min read
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
TL;DR
In 2026, Mandiant reported a surge in 'LLMJacking' incidents where threat actors hijacked access to Large Language Models, leading to massive fraudulent cloud charges. Organizations faced losses exceeding $1 million due to these attacks across various sectors globally.
✦ Why It Matters
Implement stronger access controls and monitoring for cloud resources to prevent LLMJacking.
Key Takeaways
- Regularly audit cloud configurations to identify exposed endpoints.
- Implement centralized secrets management for sensitive keys.
- Enforce least privilege access for users and service accounts.
- Utilize multi-factor authentication across all cloud services.
How It Works
Attackers exploit exposed cloud identity tokens and API keys to gain access to LLM resources. They then escalate privileges and create unauthorized API keys to monetize their access, often using proxy services to obscure their activities.