Mandiant responded to multiple incidents in 2026 involving "LLMJacking," where threat actors hijacked enterprise access to Large Language Models (LLMs). These intrusions, impacting organizations globally across various sectors, resulted in significant fraudulent cloud charges, sometimes exceeding $100,000 USD daily. Google Threat Intelligence Group (GTIG) identified diverse financially motivated threat clusters behind these compromises, noting a division of labor between initial access providers and "LLM Mixers" who monetize stolen access. The attack lifecycle involves initial access through publicly exposed LLM endpoints or stolen cloud identity tokens, such as IAM credentials and GitHub PATs. Threat actors also target LLM API keys directly, validating them stealthily to avoid detection. Later, threat actors escalate privileges, solidify access, and perform internal reconnaissance, enumerating cloud services and repositories for sensitive credentials. They abuse cloud identity permissions and VM configurations, creating unauthorized accounts and injecting SSH keys for persistence. Some actors exploit vulnerabilities in LLM routing software to gain administrative control. The ultimate goal is LLM monetization through token proxying, automated model streaming, and GPU provisioning, accumulating substantial fraudulent charges. Threat actors host their own proxy endpoints and agentic workloads, deploying containerized backdoors and provisioning powerful GPUs. They also monetize compromised API quotas by selling access through LLM Mixers, using open-source gateways to pool stolen credentials. One notable example, jet-night.com, leverages stolen API keys to offer below-market rates, passing substantial costs to victim organizations.