Mandiant Discloses Hijacking and Misuse of Enterprise LLM Access

1. 00:00
   Hacker News AI

   LLMjacking: The AWS, Google Cloud and Azure settings that cap stolen AI keys

   Google's threat team reports that attackers using stolen cloud and AI keys ran up over $100,000 in a day, and up to $1 million, on victims' model bills, entering mainly via stolen IAM credentials, service account keys and GitHub tokens, plus leaked AI keys, open Ollama servers and a LiteLLM bug. The piece converts that advice into exact settings for AWS, Google Cloud and Azure, noting that Bedrock invocation logging and Google's Data Access logs are off by default, that budget alerts do not stop spend, and that tokens-per-minute quotas are the only ceiling that works in minutes. It also finds that the LiteLLM CVE number cited by GTIG is publicly listed as a different bug, and that no public advisory covers the /key/regenerate flaw.

1. 08:32
   Hacker News AI

   Stolen AI API keys generated nearly $1M in charges for a single company

   Mandiant investigated multiple 2026 "LLMJacking" incidents in which threat actors hijacked enterprise access to large language models across cloud and LLM providers, with fraudulent charges exceeding $100,000 USD in a single day at some organizations and cumulative charges reaching $1 million USD before access was revoked. The dominant initial access vector was exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens, with actors also harvesting exposed LLM API keys from public GitHub repositories and validating them using minimal single-token requests. Google Threat Intelligence Group described a maturing ecosystem with a division of labor between actors establishing initial access and "LLM Mixers" such as jet-night.com and newapi[.]pro that proxy, aggregate, and resell unauthorized LLM access.

Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.