Cybercriminals are hijacking corporate access to large language models across the Asia-Pacific region, driving unauthorized cloud billing charges past USD $100,000 in a single day. The findings, released this week by Mandiant and the Google Threat Intelligence Group, revealed that victims spanned retail, financial services, transportation and technology across Asia Pacific, North America and South America.

For some targets, aggregate billing reached almost USD $1 million before administrators discovered the breach and revoked access keys. The financial damage mounts much faster than conventional cryptojacking, which typically drains server capacity at a slow, continuous pace. In one investigated incident, attackers executed more than 500,000 API calls against advanced language models in less than eight hours.

Intruders frequently exploit credentials leaked inside public GitHub code repositories or harvest access through compromised browser sessions and stolen identity tokens. In several documented breaches, the targeted companies had never activated machine learning or model features within their cloud accounts. Attackers simply logged into dormant environments, turned on the services themselves and began issuing high-volume automated requests.

A threat group tracked as UNC6993 gained access to corporate systems in mid-2026 by exploiting a misconfigured service account key. The group also operated a fake web portal that prompted internal users to submit active session tokens alongside JSON payloads, allowing attackers to slip past multi-factor authentication checks and passwords entirely. Another cluster extracted API keys from public repositories and tested them using single-token queries to avoid tripping intrusion detection systems.

Once inside a tenant, attackers escalated system privileges to secure their hold.

Source link