Token thieves costing companies $100K+ per day in illicit LLM charges
Google's Mandiant threat intelligence team documented a surge in 'LLMJacking'—theft of LLM API credentials and tokens to rack up illicit cloud computing charges. Threat actors exploit stolen tokens to generate additional credentials and enable unauthorized cloud services. One group (UNC6993) accumulated $100,000 in charges; another sent 200,000 API requests in two minutes. Cumulative losses at some targeted organizations have exceeded $1 million before access revocation.
Key points
- LLMJacking attacks cost victims $100K+ per day in fraudulent charges
- Threat actors use stolen tokens to generate additional credentials and services
- Some organizations lost over $1 million before discovering breaches
- Attack volume increasing steadily over past two years
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
