Google has warned of a growing enterprise threat to AI infrastructure from cybercriminals selling access to large language models (LLMs).

The tech giant’s Mandiant business said it had responded to multiple incidents so far this year across financial services, retail, technology, and transportation sectors in which “LLMJacking” techniques were discovered.

“Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours,” it warned.

“Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1m before access was revoked.”

Read more on LLMJacking: LLMjacking and Open-Source Tool Abuse Surge in 2024 Cloud Attacks.

The technique itself is not new, but the ecosystem for LLMJacking appears to be maturing.

Threat actors bypass front-end chatbots to target backend model resources, usually via LLM API keys or exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens.

From this initial foothold, the threat actors escalate privileges and carry out internal reconnaissance to identify targets and more cloud credentials.

As well as abusing and escalating permissions this way, they might also target vulnerabilities in LLM routing software to escalate privileges, the report explained.

“The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming and GPU hardware provisioning,” it added.

A Long-Term Money Spinner

Google has already seen “a diverse set” of financially motivated cybercrime clusters LLMJacking across North America, South America, and Asia Pacific. It has also started to notice a “division of labor” between threat actors that focus on initial access and those monetizing downstream infrastructure, known as “LLM Mixers.”

These routing gateways “proxy, aggregate and resell” access to LLMs for criminal customers.

The work is so lucrative that Google expects cybercriminals will prioritize LLMJacking over cryptojacking going forward.

“As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware,” it concluded.

“This operational specialization will sustain a growing illicit resale marketplace, allowing threat actors to rapidly siphon enterprise quotas while passing the billing costs to victims before compromises are detected.”