BLUF: Bottom Line Up Front
Mandiant and GTIG report 2026 incidents in which attackers hijacked enterprise LLM access, mainly through stolen cloud identity tokens and exposed API keys, running up fraudulent charges of $100,000+ in a day and up to $1 million. Stolen access is resold through "LLM Mixers." Defenders should lock down credentials, alert on LLM service enablement, enable relevant audit logs, and patch gateways such as LiteLLM.
Key Points
- Exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub PATs, session tokens) were the dominant initial access vector, though exposed LLM endpoints and leaked LLM API keys were also targeted.
- Attackers validated stolen keys with single-token requests (max_tokens=1) to avoid volume-based alerts, so defenders should watch gateway and API logs for low-volume validation pings.
- For persistence and escalation, actors created unauthorized IAM and service accounts, injected SSH keys into compute instances, and abused token-creation privileges, while a LiteLLM flaw (CVE-2026-40217) let Virtual Keys become PROXY_ADMIN credentials.
- LLM Mixers such as jet-night.com and the newapi[.]pro ecosystem pool stolen keys and resell cheap access, shifting costs to victims, with UNC6993 using tools like new-api and gcli2api.
- Defenders should treat unauthorized enablement of LLM services as critical, turn on data-plane audit logging in AWS, Azure, and GCP, and enforce least privilege, secret scanning, phishing-resistant MFA, quotas, and spending caps.