Intruders who breach corporate cloud accounts are quietly activating dormant artificial intelligence tools and running models at company expense, running up bills exceeding 100,000 dollars in a day.

Investigations carried out across 2026 by Mandiant and the Google Threat Intelligence Group revealed intrusions across Asia Pacific, North America and South America that reached cumulative costs of up to 1 million dollars before victims spotted the leaks. The compromises struck retail, transportation, financial services and technology companies that had adopted large language model architectures into their systems.

The campaign, dubbed LLMJacking, relies on a distinct commercial division of labour within cybercrime rings. One group specializes in penetrating corporate environments to harvest credentials, while a separate tier operates illicit platforms known as LLM Mixers to resell that raw model compute to third-party subscribers.

One service, trading under the name Jet Night, offered paying customers unlimited subscriptions for about 60 dollars a month to access premium foundation models. Comparable commercial access carries legitimate pricing between 100 and 250 dollars. Security investigators determined the syndicate could only sustain that price differential by powering the backend with stolen enterprise credentials.

During a single intrusion linked to the network, an unauthorized actor channeled more than 500,000 queries to foundation models in under eight hours. The targeted enterprise absorbed an unauthorized token bill approaching 1 million dollars before discovering the drain. Jet Night subsequently recorded sudden outages on its Telegram broadcast channels whenever compromised businesses identified the breach and revoked the active keys.

pro.

Source link