Most companies now hold a new kind of secret: API keys and cloud accounts that unlock large language models such as Claude, GPT, Gemini and Mistral. Those keys are valuable. Every request made with them is billed to the owner, and access to top models is restricted in some countries. That combination has created a fast-growing criminal business known as LLMjacking.
In an LLMjacking attack, criminals steal AI credentials, use them to run models at the victim's expense, and often resell the access to others through underground marketplaces and Telegram channels. The victim usually finds out when the cloud bill arrives. This guide explains how the attack works, how the stolen access is traded, and how to catch it before it becomes expensive.
What Is LLMjacking?
The term was coined in May 2024 by the Sysdig Threat Research Team. While investigating a cloud intrusion, they found attackers using stolen cloud credentials not to mine cryptocurrency or steal data, but to access hosted AI models. The attackers checked access to ten different AI services, including Anthropic, AWS Bedrock, Azure, Google Vertex AI, Mistral and OpenAI.
LLMjacking is the AI-era version of cryptojacking. Instead of stealing computing power to mine coins, attackers steal model access, and the owner of the account pays for every token generated.
Why AI credentials are such an attractive target
- They are worth real money. Premium models are expensive per token, so a single key with high limits can generate a large bill quickly.
- They are easy to resell. Access can be wrapped behind a proxy and sold to many buyers without revealing the underlying key.
- They bypass restrictions. Stolen access lets buyers get around regional bans, sanctions and the safety controls tied to their own accounts.
- They are often poorly protected. Developers paste keys into code, notebooks and config files far more casually than they would a database password.
How Attackers Steal AI Credentials
How attackers test a stolen key quietly
Attackers try not to trigger alarms before they start using a key. Sysdig observed requests deliberately built to fail with a validation error, which confirms the key works without running a real prompt. Google Threat Intelligence describes keys harvested from GitHub being tested with tiny one-token requests. Attackers have also checked whether the victim logs prompts and responses before using the model, so they know if they are being watched.
What Attackers Do With Stolen AI Access
1. Resell it
The most common goal is profit. In the first case Sysdig documented, the traffic came through an open-source reverse proxy that lets one operator manage many stolen LLM accounts behind a single endpoint, then sell access to other users.
2. Get around bans and sanctions
Sysdig found that many LLMjacking requests came from users in countries where major AI providers restrict access, including Russia. Stolen Western cloud accounts give them a way in.
3. Bypass safety controls
In February 2025 Microsoft named members of a network it tracks as Storm-2139. According to Microsoft, the group used customer credentials scraped from public sources to break into Azure OpenAI accounts, changed the services' capabilities, resold access, and gave buyers instructions for generating harmful content, including non-consensual explicit images. Microsoft took legal action and obtained a court order to seize a website central to the operation.
4. Power attacks against others
The newest trend is using stolen AI compute as attack infrastructure. In June 2026 Sysdig documented an exploitation framework that used a hijacked, unauthenticated Ollama server as its reasoning engine to fingerprint targets, generate exploits and escalate privileges with no human in the loop. In that case the victim's AI server became a tool for attacking third parties.
How Stolen AI Access Is Sold
LLMjacking has developed a supply chain that looks a lot like other dark web markets:
- Key harvesters scan public repositories, exposed servers and stealer logs for valid AI credentials.
- Relay operators pool stolen keys behind proxy gateways, which Google Threat Intelligence calls "LLM mixers", so buyers never see the underlying keys. When one key is revoked, the relay switches to another.
- Resellers advertise cheap or "unlimited" plans on underground forums and Telegram. Google Threat Intelligence describes one relay service selling an unlimited plan for about $60 a month, well below the price of legitimate access, and announcing outages on Telegram that appeared to follow key revocations.
- End users buy access for chatbots, content generation, role-play services or as a way around restrictions.
The Cloud Security Alliance reports that one campaign, called Operation Bizarre Bazaar, recorded around 35,000 attack sessions between December 2025 and January 2026, roughly 972 a day, alongside a marketplace reselling access to more than 30 AI providers.
Stolen AI keys circulate in stealer logs, paste sites, forum posts and Telegram channels before and during abuse. Catching your organisation's keys or developer credentials there is often the earliest warning you get.
What LLMjacking Costs Victims
The direct cost is the bill. Sysdig estimated a worst case of more than $46,000 a day in its first 2024 case, based on the model quotas available to the attacker. Later that year it estimated that abuse of more expensive models could exceed $100,000 a day. By 2026 those were no longer just estimates: Google Threat Intelligence and Mandiant reported individual incidents with fraudulent charges above $100,000 a day, and cumulative charges near $1 million at some organisations before access was cut off.
Two techniques make the damage worse:
- Turning on disabled models. Even if your company never enabled a given AI service, an attacker with enough cloud permissions can enable it, and charges can start within minutes.
- Burn and rotate. Attackers repeatedly create and delete short-lived service accounts to dodge rate limits and keep usage high.
Beyond the bill, there are other risks: your account may be suspended for policy violations you did not commit, harmful content may be generated under your organisation's name, and an attacker who can call AI services often has other cloud permissions too.
Warning Signs of LLMjacking
DarkThreat monitors stealer logs, paste sites, forums and Telegram channels for exposed credentials and secrets linked to your domains, so you can rotate a leaked key before it is resold. See DarkThreat plans.
How to Prevent LLMjacking
- Inventory every AI key and endpoint. List which teams use which AI providers, through which accounts and keys.
- Treat AI keys as privileged secrets. Store them in a secrets manager, never in code, notebooks or shared documents, and rotate them on a schedule.
- Scan your full code history. Use secret scanning on all repositories, including old commits, and add AI key formats to your scanners.
- Set spending limits and alerts. Provider-level budgets and billing alerts can catch abuse within hours instead of at month end.
- Block AI services you do not use. Use cloud policies to prevent anyone from enabling models or regions your organisation does not need.
- Turn on model invocation logging. Log who calls which model, from where, and how often.
- Lock down self-hosted models. Never expose Ollama, vLLM or similar servers to the internet without authentication.
- Apply least privilege. Do not give workloads or developers permission to call or enable AI services unless they need it.
- Monitor for leaked credentials. Watch stealer logs and underground channels for your developers' cloud logins and keys, and rotate immediately when they appear.
Key Takeaways
- LLMjacking is the theft and abuse of AI API keys and cloud AI access, with the victim paying the bill.
- Keys are stolen from public code, vulnerable apps, misconfigured service accounts, stealer logs and exposed AI servers.
- Stolen access is pooled behind relays and resold cheaply on forums and Telegram.
- Documented incidents have exceeded $100,000 a day in fraudulent charges.
- Spending limits, secret management, logging and dark web monitoring for leaked keys are the best defences.
Frequently Asked Questions
What is the difference between LLMjacking and cryptojacking?
Both hijack resources you pay for. Cryptojacking uses your computing power to mine cryptocurrency, while LLMjacking uses your AI model access to generate text, images or code for the attacker or their customers.
Can LLMjacking happen if we never enabled an AI service?
Yes. If an attacker steals cloud credentials with enough permissions, they can enable AI services themselves. Blocking unused services with cloud policies prevents this.
Will the AI provider refund fraudulent charges?
Sometimes, but it is not guaranteed and depends on the provider and on whether you followed their security guidance. Prevention and fast detection are far more reliable than relying on a refund.
What should we do if we find a leaked AI key?
Revoke and replace it immediately, review usage and billing for the period it was exposed, check audit logs for other actions taken with the same credentials, and find out how it leaked so it does not happen again.
How does dark web monitoring help against LLMjacking?
Stolen keys and developer credentials often appear in stealer logs, paste sites and Telegram channels before or during abuse. Spotting them there lets you rotate the key before it is pooled into a reseller's relay.
Related Resources
- Dark Web Monitoring for API Key Leaks: Developer Security Guide
- How to Protect Your API Keys from Dark Web Exposure
- Credential Leak Detection for Cloud Infrastructure (AWS, Azure, GCP)
- Credential Monitoring for Non-Human Identities (NHI) and Bots
- Infostealer Logs: What They Contain and Why You Need to Monitor Them
- Dark Web Monitoring for SaaS and Technology Companies
Sources
- Sysdig: LLMjacking, stolen cloud credentials used in new AI attack
- CyberInsider: LLMjacking attacks escalate, driving costs to over $100,000 a day
- The Hacker News: Microsoft exposes LLMjacking cybercriminals behind Azure AI abuse scheme
- Cloud Security Alliance: LLMjacking evolves, stolen AI compute as attack infrastructure
- XenoSpectrum: Mandiant reports LLMjacking incidents over $100K per day
