Stolen cloud keys let attackers run up $100,000 AI bills in a day, Mandiant says

Mandiant says attackers hijacked organizations’ access to AI models in several 2026 incidents it handled, most often with exposed or stolen cloud credentials. Fraudulent charges topped $100,000 in a single day, and some organizations reached $1 million before they revoked the attackers’ access. Google’s threat intelligence group says resellers it calls LLM Mixers pool the stolen access and sell it to subscribers. The victims were in financial services, retail, technology and transportation, in North America, South America and Asia Pacific.

The most common way in was exposed or stolen cloud identity credentials: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. Other attackers found AI model servers exposed to the internet. One collected corporate AI API keys from public GitHub repositories and tested each with a one-token request, which stayed below the victim’s volume alerts. Inside, attackers enabled AI services that had been off and created more API keys and service accounts. One kept creating and deleting short-lived service accounts to get around rate limits.

Google tracks one group as UNC6993. In mid-2026 it got into a cloud instance through a misconfigured service account key. It then tried to create more API keys and turn on services, running up more than $100,000 in charges. It also hosted a fake application portal that tricked users into pasting their access tokens, which got it past passwords and MFA. Another attacker made more than 500,000 model calls in under eight hours with stolen keys to power Jet Night, a token routing service. Jet Night passed nearly $1 million in costs to the victim.

In one investigation, a second group acquired validated keys from the attacker that broke in, Mandiant says. It then exploited a flaw in the victim’s LiteLLM gateway, an open-source proxy for AI models, to turn ordinary virtual keys into master administrator credentials. Mandiant describes it as a user ID rebind flaw in the gateway’s key regeneration endpoint. Another attacker ran proxy servers on lookalike domains, one posing as the victim’s own internal host, to feed the victim’s AI quota into a resale site.

Mandiant hasn’t said how many organizations were hit, or which cloud and AI providers each incident involved, beyond saying they spanned several. It publishes two reseller domains, and its full indicator list is in a Google Threat Intelligence collection for registered users.