The $100,000 Daily Cloud Burn: Architecture and Economics of Enterprise LLMjacking
Google and Mandiant uncover organized threat actors draining enterprise foundation model quotas, driving single-day cloud bills past six figures.
Published: 2026.11.04
Observed daily compute spend per compromised project
Cloud spend accrued before credential revocation
Illicit mixer tier offering siphoned frontier model access
Architectural Mechanics: How LLMjacking Exploits Cloud Identity to Drain Model Endpoints
Enterprise security teams have spent years calibrating threat models for cryptojacking, where adversaries quietly siphon spare CPU and GPU cycles to mine digital assets without triggering immediate budgetary tripwires. Google Threat Intelligence Group and Mandiant revealed that threat actors have shifted to LLMjacking—a targeted campaign that hijacks foundational model APIs, cloud inference quotas, and managed AI accelerators. Because frontier foundation models incur high per-token pricing and dedicated GPU capacity costs, malicious traffic generates devastating financial impacts in hours rather than months.
The initial access vectors rely on credential hygiene failures across developer environments. Adversaries harvest cloud Identity and Access Management (IAM) credentials, Service Account private keys, and GitHub Personal Access Tokens (PATs) from public source repositories and containerized web application vulnerabilities. In tracked campaigns attributed to threat group UNC6993, operators deployed fake developer onboarding portals to conduct session hijacking, prompting internal engineers to paste raw JSON tokens containing valid authentication sessions. This technique circumvents multi-factor authentication (MFA) and grants direct access to downstream model endpoints.
End-to-end credential compromise and automated token proxying pipeline
Extraction of Service Account keys, session tokens, and PATs via repo leaks and phishing
Replay of raw JSON bearer payloads to bypass corporate MFA gates
Burn-and-rotate generation of ephemeral service accounts to evade tenant rate limits
Exposing stolen endpoints to third-party proxy gateways and autonomous agent pipelines
Once inside a victim cloud tenancy, threat actors establish persistence by provisioning auxiliary API keys and temporary service accounts. To circumvent cloud tenant rate limits and quota caps, groups like UNC6993 implement automated burn-and-rotate scripts that instantiate short-lived service accounts, blast model inference requests at maximum concurrency, and terminate the credentials before security monitoring flags abnormal transaction density.
Financial Telemetry: Cryptojacking vs. LLMjacking Consumption and Daily Run-Rate Exposure
The unit economics of foundation model inference fundamentally alter the financial blast radius of identity compromise. While unauthorized Monero mining yields pennies per server-hour and produces distinct CPU saturation spikes, high-concurrency API calls against frontier models like Gemini 1.5 Pro, Claude 3.5 Sonnet, or GPT-4o consume operational capital at exponential velocity.
Across documented enterprise breaches spanning North America, South America, and APAC, Mandiant observed fraudulent charges exceeding $100,000 in a single 24-hour cycle. In several enterprise tenancies across the financial, logistics, and retail sectors, cumulative unmonitored charges crossed $1,000,000 before engineering teams identified and revoked the compromised credentials.
Direct financial exposure and time-to-detection comparison
The financial disparity stems from model pricing structures. Generating millions of reasoning tokens or spinning up on-demand GPU clusters costs substantial sums on standard enterprise cloud billing sheets. If an engineering organization lacks hard billing quotas and continuous token telemetry, automated attack pipelines saturate concurrent requests across enterprise quotas without generating anomalous hardware performance signals on local virtual machines.
| Metric / Dimension | Legacy Cryptojacking | Enterprise LLMjacking |
|---|---|---|
| Primary Resource Stolen | Unallocated CPU/GPU compute cycles | Managed model API quotas & token bandwidth |
| Average Detection Latency | 30 to 90 days (via host performance alerts) | 2 to 14 days (typically via invoice shock) |
| Single-Day Financial Burn | $15 – $40 per compromised node | Exceeding $100,000 per project |
| Cumulative Impact Ceiling | Minimal direct compute liability | Documented enterprise losses up to $1,000,000 |
| Network Egress Profile | Outbound stratum protocol traffic | Standard HTTPS traffic over port 443 |
| Monetization Route | Direct cryptocurrency wallet deposits | Grey-market token resale via proxy storefronts |
Underground Monetization: The Emergence of LLM Mixers and CLI Relay Infrastructure
The industrialization of LLMjacking has driven an underground division of labor between access brokers and downstream resellers. Similar to cryptocurrency mixing services that obfuscate illicit capital flows, threat actors now operate LLM Mixers. These platforms ingest stolen enterprise API credentials, pool them into centralized proxy gateways, and market siphoned token bandwidth to third parties.
One prominent illicit platform, Jet Night (jet-night[.]com), sells unlimited frontier model access for roughly $60 per month. By multiplexing hundreds of illicit enterprise API tokens behind a single consumer-facing interface, the service extracts recurring subscription revenue from buyers while the victimized enterprise absorbs the massive underlying inference billing.
Symantec and Carbon Black telemetry on hijacked developer environments
Research from Broadcom-owned Symantec and Carbon Black highlights a parallel vector: rogue client-side reconfigurations of legitimate developer tools. In regions subject to export controls or vendor geofencing, including Mainland China and manufacturing clusters across Malaysia, South Korea, and Taiwan, third-party distribution packages wrap official command-line interfaces such as the OpenAI Codex and Anthropic Claude Code CLIs.
Rather than authoring custom malware, these malicious installers configure developer CLI tools to disable local sandboxing flags, setting configuration flags to danger-full-access. The installation scripts re-route standard API traffic through unauthorized relay servers. This architecture simultaneously intercepts sensitive codebases transmitted in inference prompts and captures persistent corporate API keys to populate illicit token mixers.
Hardening Enterprise LLM Infrastructure: Budget Quotas, Identity Baselines, and Egress Controls
Mitigating LLMjacking requires security leadership to treat model endpoints and LLM API credentials as high-risk cryptographic material, equivalent to root database credentials or cloud master keys. Relying on monthly invoicing reconciliations to catch credential compromise guarantees catastrophic exposure. Engineering teams must implement defense-in-depth measures across identity lifecycles, network perimeters, and cloud financial governance.
Actionable controls to detect token hijacking and stop financial drainage
Deprecate long-lived service account keys in favor of short-lived OIDC workload identity federation and IMDSv2 enforcement.
Route all enterprise model queries through managed VPC endpoints; block unauthorized outbound proxy domains at developer workstations.
Deploy automated cloud billing alerts that revoke IAM roles immediately when inference run-rates exceed 300% of rolling hourly baselines.
Eliminate Static Service Account Keys and Harden Developer CLIs
Long-lived Service Account keys stored on developer workstations or committed to source control represent the primary initial attack surface. Organizations must mandate Workload Identity Federation and ephemeral token issuance via OpenID Connect (OIDC) across all continuous integration pipelines.
Security teams must audit developer environments for unofficial CLI tool wrappers. Enforce strict configuration locks via Mobile Device Management (MDM) to ensure official developer tools cannot have their endpoint URLs re-routed to third-party proxies, and block unauthorized executions where local sandboxes are deliberately disabled.
Implement Strict API Rate-Limiting and Granular Quotas
Cloud project administrators frequently grant excessive model consumption quotas to prevent development disruption. This operational convenience grants attackers an open checkbook.
Model deployment configurations in cloud consoles must feature strict daily request limits and concurrency boundaries pegged to realistic internal team requirements. Isolate developer testing, internal tooling, and production services into distinct, billing-segregated cloud projects to prevent a staging compromise from tapping production budgets.
Deploy Automated Billing Kill-Switches and Real-Time Token Telemetry
Traditional cloud billing alerts that ping email distribution lists when a budget reaches 80% of its monthly ceiling fail against attacks that burn $100,000 in a day. Security operations centers must ingest raw cloud audit logs and API gateway access metrics into centralized detection pipelines.
Establish behavioral detection rules that monitor rolling hourly inference costs and token velocity. If API consumption spikes past a baseline threshold—such as 300% of historical peak hourly spend—automated serverless functions must immediately deactivate the associated service account, revoke active OAuth sessions, and scale the endpoint quota to zero pending manual verification.