LLMjacking: Stolen Cloud Credentials Used to Resell LLM Access

Cybercriminals are hijacking stolen cloud credentials to resell unauthorized access to large language models, with some victim organizations incurring resource-consumption bills as high as $1 million before access was revoked.

Disclosed 3 November 2026 · Record updated 3 November 2026

Impact

Victim organizations incurred unauthorized cloud LLM usage charges, in some cases up to $1 million, due to stolen credentials being resold by cybercriminals for LLM access.

Our coverage

A thief's lockpicks hang from a merchant's stall while victims' meters spin wildly backward, their coffers draining as unauthorized machines feast on borrowed power.

Incidents

Stolen cloud keys fuel a resale market for LLM access

Dark Reading reported on 3 November 2026 that some victims ran up resource bills of as much as $1 million before access was cut off.

3 Nov 2026

Sources

darkreading.comhttps://darkreading.com/cloud-security/llmjacking-thriving-cybercriminal-enterprise