Skip to content
NewsIncident

Google says a stolen-key reseller billed one victim nearly $1 million in LLM charges in under 8 hours

· by

The short version

Google Cloud's Mandiant team detailed Jet Night, an underground service that resold stolen LLM API keys at $60 a month, and traced one attack that made 500,000+ API calls and billed almost $1 million before the keys were revoked.

Google says a stolen-key reseller billed one victim nearly $1 million in LLM charges in under 8 hours

One compromised set of API credentials was enough for an attacker to fire off more than 500,000 LLM calls in under eight hours and stick the victim with close to $1 million in token charges, according to research Google Cloud published on November 2, 2026.

What happened

Google's Threat Intelligence Group, which includes the Mandiant incident-response team, published a report titled "The Rise of LLMJacking" describing how attackers hijack stolen cloud credentials to run unauthorized inference workloads, a pattern it calls LLMjacking. The report names a specific underground service, Jet Night (jet-night.com), that resold access built on those stolen keys at roughly $60 a month for unlimited tokens, well under the $100 to $250 a month that legitimate unlimited plans typically cost, per Google. In the case GTIG describes, a threat actor using stolen third-party keys made over 500,000 LLM API calls in under eight hours through Jet Night's routing service, passing nearly $1 million in charges to the victim organization before the keys were revoked.

Google ties the activity to a broader "LLM Mixer" ecosystem: open-source proxy and gateway tools, including LiteLLM, new-api, and gcli2api, repurposed to pool stolen keys, meter underground subscriber usage, and mask where the traffic originates. GTIG separately flagged a threat cluster it calls UNC6993, which ran up more than $100,000 in a different cloud billing spree by provisioning new API keys inside a compromised account. Affected surfaces across the incidents Mandiant investigated include AWS Bedrock, Google's Gemini API, and Microsoft's Azure Cognitive Services, reached mostly through valid stolen credentials rather than a software exploit.

A leaked key becomes a resold subscription

For teams running agents or AI features in production, this changes what a leaked key actually costs. A credential that leaks into a public repo or a misconfigured service account is no longer just a one-time abuse risk; per Google, it can become inventory in an underground marketplace that keeps billing against the victim's account until the key is caught and revoked. Jet Night's sub-market pricing is itself a tell GTIG uses to identify these services: if a reseller's rate undercuts the real cost of frontier-model tokens, the keys underneath it are very likely stolen. Any team that brokers API credentials through a gateway, including the automation platforms Pondero covers like n8n, Make, and Pipedream, has the same exposure if a connected key leaks.

Google's own mitigation list, aimed at defenders, points at the practical fixes: centralized secret management with automatic rotation, least-privilege scoping per key and per model, budget alerts and hard spending caps on LLM services specifically, and routine scans for keys committed to source code. None of that is new security advice, but Google's framing is that LLM billing needs its own quota and spend controls, not just the IAM policy teams already have for compute and storage.

What to watch next

GTIG's write-up anonymizes the organization that absorbed the nearly $1 million bill, so whether that victim or its cloud provider discloses the case independently is still open. It is also worth watching whether AWS or Microsoft publish their own LLMjacking incident counts; so far this report is Google's accounting of activity it observed across multiple cloud providers, not a joint disclosure.

Sources