Threats · 5h ago

Stolen LLM keys now feed a resale economy

Google Mandiant says it responded to multiple LLMJacking incidents in 2026 across four sectors and three regions, with fraudulent usage exceeding $100,000 in a day and reaching $1 million cumulatively at some organizations. The cases affected financial services, retail, technology, and transportation organizations in North America, South America, and Asia Pacific.

In one case, the group UNC6993 used stolen LLM API keys to create more keys and enable services in a victim’s cloud project. Mandiant also describes operators called “LLM Mixers” that proxy and resell unauthorized model access, separating initial break-ins from downstream sales. A stolen key can therefore lead to both expanded access and a market for the stolen capacity.

For organizations whose cloud credentials can create keys or enable paid services, revoking the first token may leave attacker-created access—and its billing path—inside the project.

Timeline

• Nov 2 Reported by The Register Security

Sources

2 sources covering this story

• The Register Security Nov 2

  Token thieves costing companies $100K+ per day in illicit LLM charges

  Don't let the LLMjackers hit you

• Mandiant Nov 2

  The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources | Google Cloud Blog

  Mandiant reveals how LLMJacking attacks cost victims hundreds of thousands in fraudulent cloud bills, with underground markets targeting LLM credentials.

Entities

• CVE-2026-40217
• UNC6993

Part of the PlainSec briefing for 2026-11-02

Editions

• Briefing for 2026-11-02

Related stories

• FBI names TraderTraitor as Binance laundering continues
• Cursor auto-updates could spread a trojanized Claude Code extension
• BITTER’s native-tool chain slips past malware-only hunts