Katta til modellari o'g'irlanishi hujumlari, shuningdek LLMjacking deb ham ataladi, katta firibgar bulut to'lovlarini keltirib chiqarmoqda, ba'zi tashkilotlar kuniga 100 000 dollardan ortiq yo'qotishmoqda.
Kompaniyalar o'g'irlangan API kalitlari yordamida firibgar qo'ng'iroqlar tufayli 1 million dollargacha bo'lgan xarajatlarni qayd etishlari mumkin, deb Google Threat Intelligence Group (GTIG) va Mandiant tadqiqotchilari tahlil qilingan hodisalarda aytishdi.
Ularning kuzatishlariga asoslanib, "korporativ LLM infratuzilmasini buzish va monetizatsiya qilish bilan shug'ullanadigan ikkita alohida operatsion klaster mavjud".
Tadqiqotchilar tahdid aktorlarining ikkita toifasini aniqladilar: ommaviy ochiq LLM endpointlarini skanerlovchilar va himoyalanmagan mashinalardan haqiqiy API kalitlarini o'g'irlaydiganlar.
Dastlabki kirishdan so'ng, hujumchilar uni LLM mikserlari deb ataladigan xizmatlarga sotadilar, bu xizmatlar o'z obunachilariga LLMlarga ruxsatsiz kirish imkonini beradi.
Kirish qayta sotilgandan so'ng, so'rovlar hajmi to'satdan ko'tarilishi mumkin, ba'zan soniyada 1000 dan ortiq so'rovga yetadi. Xizmat provayderi so'rovlarni qonuniy iste'mol sifatida qayd etadi va qurbon tashkilotdan tokenlar uchun to'lov oladi.
LLMjacking foydalanish o'sishi Manba: Google
GTIG va Mandiant bu turdagi faoliyatning bu yil oshganini kuzatdilar, bir kunda 100 000 dollardan ortiq firibgar to'lovlar va ba'zi tashkilotlarda jami 1 000 000 dollarga yetgan to'lovlar bilan.
LLM mikserlari AI resurslariga juda past narxlarda kirish taklif qiladi, o'z proksi infratuzilmasidan foydalanib mijozlar so'rovlarini o'g'irlangan API kalitlari orqali buzilgan xizmatlarga yo'naltiradi.
Tadqiqotchilar bunday yo'naltirish infratuzilmasining bir nechta misollarini topdilar, jumladan Jet Night, u oyiga 60 dollar evaziga "cheksiz kirish rejalarini" sotadi, va yangiapi[.]pro xizmati.
"Sakkiz soatdan kamroq vaqtda 500 000 dan ortiq LLM API qo'ng'iroqlarini amalga oshirgan boshqa tahdid aktori o'g'irlangan uchinchi tomon API kalitlaridan foydalanib token yo'naltirish xizmati jet-night.com ni quvvatladi," deb aytadi Google.
"Jet Night qurbon tashkilotga deyarli bir million dollar token xarajatlarini yukladi."
Jet Night narx rejalari Manba: Google
Google shuningdek UNC6993 tahdid klasterini aniqladi, u o'g'irlangan kalitlarni jamlash va so'rovlarni tarqatish uchun shlyuz vositalaridan foydalanadi va ehtimol yer osti forumlari orqali kirish sotadi.
Hujumchilar ochiq yoki buzilgan bulut ma'lumotlari, xizmat hisob kalitlari, GitHub tokenlari, faol sessiya tokenlari va LLM API kalitlari orqali kirishadi.
Hujumchilar buzilgan muhitda ma'lumotlar, jurnallar, ma'lumotlar bazalari va maxfiy boshqaruvchilarni qidiradi va doimiy kirishni saqlab qolish uchun orqa eshik hisoblari yaratishga yoki SSH kalitlarini kiritishga harakat qiladi.
Tadqiqotchilar shuningdek CVE-2026-40217 zaifligidan foydalanishni kuzatdilar, bu LiteLLM dagi zaiflik bo'lib, maxsus kod himoya sinov endpointidan foydalanib serverda ixtiyoriy kodni ishga tushirishga imkon beradi.
Ba'zi hollarda, Google aytishicha, hujumchilar qurbonning bulut infratuzilmasidan ruxsatsiz proksi endpointlari va agentik yuklamalarni joylashtirish uchun foydalangan.
"Masalan, bir tahdid aktori agentlarni yoqdi, ommaviy kirish mumkin bo'lgan teskari proksilarni joylashtirdi va D1337-KAIROS nomi bilan tanilgan shaxs ostida bir nechta oldingi LLMlar bilan mos keladigan endpointlarni ochish uchun maxsus Node.js proksi to'plamlaridan foydalandi," deb aytishadi tadqiqotchilar.
Google LLMjacking hujumlaridan himoyalanish uchun bir nechta harakatlarni tavsiya qiladi, bu Identifikatsiya va Kirish Boshqaruvi (IAM) ni ustuvor qilish va ta'minot zanjirini himoyalashdan boshlanadi.
Kompaniyalar sezgir kalitlar va maxfiy ma'lumotlarni aylantirish va boshqarish uchun markazlashtirilgan maxfiy platformalardan foydalanishlari kerak. Foydalanuvchilar o'z roli va vazifalari talab qilmasa, kengaytirilgan huquqlarga ega bo'lmasligi kerak.
"Aynan talab qilinmagan barcha ruxsatlarni rad eting, jumladan Cloud LLM xizmatlariga kirish," deb tavsiya qiladi Google.
Fishingga chidamli ko'p omilli autentifikatsiyani (MFA) joriy etish, monitoring vositalari ruxsatsiz LLM va AI xizmatlarini (soyali AI) aniqlash uchun muhit bo'ylab to'liq ko'rinishni ta'minlashini ta'minlash va API foydalanish va sarf-xarajat cheklovlarini o'rnatish tashkilotlarga LLMjacking hujumlarini erta aniqlash, ularning ta'sirini cheklash yoki ularni butunlay oldini olishga yordam beradi.
Bundan tashqari, bulut audit va xulosa jurnallari yoqilishi va ruxsatsiz xizmat faollashtirish, shubhali ma'lumot tekshiruvlari, g'ayrioddiy foydalanish va jurnallarni o'chirishga urinishlar uchun kuzatilishi kerak.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Companies can record costs as high as$1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.
Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure."
The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.
After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The service provider records the requests as legitimate consumption and charges the victim organization for the tokens.
LLMjacking usage spike Source: Google
GTIG and Mandiant observed an increase in this type of activity this year,with fraudulent charges exceeding $100,000 in a single day, and cumulative charges at some organizations reaching $1,000,000.
LLM mixers offer access to AI resources at very low prices, using their proxy infrastructure to relay customers' prompts to hijacked services through stolen API keys.
The researchers found several examples of such relaying infrastructure, including Jet Night, which sells “unlimited access plans” for $60/month, and the newapi[.]pro service.
“Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com,” Google says.
“Jet Night passed nearly one million dollars in token costs to the victim organization.”
Jet Night pricing plans Source: Google
Google also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums.
The attackers gain access via exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys.
Attackers search the compromised environment for credentials, logs, databases, and secret managers, and try to create backdoor accounts or inject SSH keys to maintain persistent access.
The researchers have also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows running arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.
In some cases, Google says that attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads.
"For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS," the researchers say.
Google recommends several actions to protect against LLMjacking attacks, which start with prioritizing Identity and Access Management (IAM) and securing the supply chain.
Companies should use centralized secrets platforms to enable the rotation and management of sensitive keys and secrets. Users should not have extended privileges unless required by their role and tasks.
"Deny all permissions that are not explicitly required, including access to Cloud LLM services," Google recommends.
Enforcing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility across the environment to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can help organizations detect LLMjacking attacks early, limit their impact, or prevent them altogether.
Furthermore, cloud audit and inference logs should be enabled and monitored for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.