Google links UNC6993 to over $100,000 LLMjacking bills
Google’s Threat Intelligence Group says thieves who steal AI accounts and cloud credentials can run costly workloads so fast that victims face six-figure bills almost at once.
Google’s Threat Intelligence Group says LLMjacking can push cloud AI bills past $100,000 within minutes.
Attackers steal API keys, identity tokens, service-account keys, GitHub tokens, and session tokens, or abuse exposed AI endpoints.
A group tracked as UNC6993 reportedly caused more than $100,000 in charges after obtaining LLM API keys and enabling cloud services.
Some criminals sell stolen access through “LLM Mixers” that proxy requests for underground buyers.
Google advises least privilege and treating unauthorised AI account or service changes as serious security incidents.