受害组织正因犯罪分子劫持其企业大语言模型（LLM）访问权限以窃取昂贵的计算资源和 AI 服务，而损失数百万美元的 Token 费用。根据 Google Mandiant 事件响应团队周一发布的一份报告，这些由资源消耗产生的欺诈性费用每天可能超过 10 万美元，一些组织的累计费用在受害公司撤销入侵者访问权限前已高达 100 万美元。
Victim organizations are losing millions of dollars in token charges as criminals hijack their corporate LLM access to steal expensive computing resources and AI services. These fraudulent charges from resource consumption can exceed $100,000 a day, according to a Monday report by Google's Mandiant incident responders, who saw cumulative charges at some organizations hit $1 million before the victim companies revoked intruders' access.
“只要有可能，威胁行为体都想利用这项技术在规模上获得相对于防御者的优势。他们通过代理工具以及从不知情的第三方窃取 Token 来实现这一点，”Google 威胁情报小组首席分析师 John Hultquist 告诉《The》（注：原文此处疑有省略，应为媒体名称）。“锁定这些资源不仅能保护组织免受失控成本的侵害，也能保护更广泛的社区免受廉价、自主攻击的洪流冲击。”
"Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties,” John Hultquist, chief analyst at Google Threat Intelligence Group, told The.
这种劫持 LLM 访问权限的战术被称为“LLMJacking”（LLM 劫持），在过去两年里稳步增加。CrowdStrike 8 月的一份报告记录了一个极端案例：一名 Token 窃贼在短短两分钟内发送了约 20 万次 API 请求。
“Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.”This tactic of hijacking access to LLMs is called LLMJacking, and it’s been increasing steadily over the past two years.
报告详述的一个案例中，Google 追踪的一个组织（编号 UNC6993）非法获取了 LLM API 密钥，随后生成额外密钥并在受害者的云项目中启用服务，导致 10 万美元的费用。该威胁情报公司还记录了另一名 Token 窃贼将受害者账户订阅为“即用即付”协议，以受害公司的资金访问高级模型。该窃贼选择了高级基础模型，发起大批量推理流，并采用“烧毁并轮换策略”，通过创建和删除短期服务账户来绕过速率限制，同时审核账单界面以监控财务影响。
In one extreme case, documented in an August report from CrowdStrike, a token thief sent about 200,000 API requests in just two minutes. In one case detailed in the report, a group Google tracks as UNC6993 illicitly gained access to LLM API keys, then generated additional keys and enabled services within the victim’s cloud projects, racking up $100,000 in charges. The threat intel biz also documented a different token thief subscribing victim accounts to Pay-As-You-Go agreements to access advanced models on the victim company’s dime.
在另一起事件中，根据谷歌周一发布的一份报告，一名入侵者利用被盗的第三方 API 密钥，在不到八小时内执行了超过 50 万次 LLM API 调用，为名为 Jet Night 的令牌路由服务提供动力。“鉴于 Jet Night 对用户的单令牌成本远低于典型市场费率，GTIG 认为该服务依赖被盗密钥才能盈利运营，”报告称。“例如，Jet Night 提供约 60 美元/月的无限令牌套餐，据称可访问前沿模型，而同等级别的消费者服务通常每月收费在 100 美元至 250 美元之间。”
The crook selected premium foundation models, launched high-volume inference streams, and used a “burn and rotate strategy” to bypass rate limits by creating and deleting short-lived service accounts while auditing the billing interface to monitor financial impact. In yet another incident, an intruder executed more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys to power a token routing service called Jet Night, according to a Monday report from Google. “Given Jet Night’s per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably,” the report says.
Jet Night 还在其公开的 Telegram 频道上承认发生过多次中断，谷歌威胁猎人指出，这“很可能是因为受害者发现各自的密钥泄露后撤销了被盗密钥所致。”
“For example, Jet Night offers an unlimited token plan for approximately $60 USD per month with alleged access to frontier models, a consumer service level that would typically run between $100 and $250 per month.”
专业化的 LLM 劫持角色 随着更多犯罪分子加入 LLM 劫持生态系统，谷歌表示已记录到犯罪分子之间出现了分工：一方负责建立对受损云和 AI 服务的初始访问权限，另一方则管理下游变现基础设施，被称为“LLM 混合器”。在曼迪昂特于 2026 年中旬处理的一个案例中，UNC6993 通过配置错误的服务账号密钥攻破了一个云实例，并利用该访问权限进一步授予模型 API 的访问权限。
Jet Night has also admitted to multiple outages on its public Telegram channel, which the Google threat hunters note is “likely due to stolen keys being revoked as victims discover their respective compromises.”Specialized LLMjacking roles As more criminals join the LLMJacking ecosystem, Google says it has documented a division of labor between the criminals that establish initial access to compromised cloud and AI services, and those that manage downstream monetization infrastructure, called “LLM Mixers.”
犯罪分子还搭建了一个会话劫持页面，伪装成加入 LLM 用户群组的申请门户。“该页面诱使用户访问合法的 LLM 服务网站，并粘贴包含有效访问令牌的原始 JSON 负载，随后该负载被发送到后端 API，从而绕过密码和多因素认证（MFA）控制，”报告称。谷歌预测，与加密货币劫持等其他类型的资源盗窃相比，不法分子将“越来越优先考虑 LLM 劫持”。
In one case that Mandiant responded to in mid-2026, UNC6993 compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to a model API. The crooks also spun up a session hijacking page purporting to be an application portal to join a group of LLM users. “This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multifactor authentication (MFA) controls,” the report says.
为了防止云端大语言模型服务被滥用，该安全公司表示，防御者应优先考虑身份与访问管理以及供应链安全，并使用集中式密钥管理平台来轮换密钥和机密。同时，应对用户和服务账户实施最小权限原则，确保它们仅拥有完成各自角色和任务所必需的权限。此外，还应在代码库中自动化机密扫描，以识别并移除添加到源代码中的任何 API 密钥和机密。®
Google predicts miscreants will “increasingly prioritize LLMJacking” compared to other types of resource theft like cryptojacking. And to prevent cloud LLM service abuse, the security firm says defenders should prioritize identity and access management plus supply chain security, and use a centralized secrets management platform to rotate keys and secrets. Also apply least-access privileges to users and service accounts, ensuring that they only have permissions necessary to complete their roles and tasks. And automate secrets scanning within codebases to identify and then remove any API keys and secrets added to source code. ®