thehackernews.com
Nov 4, 2026
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
AI-summarised brief · reviewed before publication
Google warned that cybercriminals are hijacking enterprise access to large language models (LLMs) in a tactic dubbed LLMjacking, causing sudden, massive cloud bill spikes. Attackers obtain API keys through phishing, leaked credentials, or exposed code, then consume expensive GPU resources, generating up to $100,000 in daily charges and $1 million before detection. The threat spans North America, South America, and Asia Pacific across finance, retail, tech, and transportation, with actors like UNC6993 exploiting misconfigured service accounts and token‑proxying to monetize LLM usage.
💡 Why It Matters
- · The rapid, high‑cost exploitation exposes a new vector for financial loss that outpaces traditional cryptojacking, forcing enterprises to reassess API key hygiene and monitoring.
- · It also signals a shift toward organized, profit‑driven LLM abuse, raising the stakes for cloud security protocols.
