Google Threat Intelligence Group has identified a rise in LLMjacking, a tactic where attackers compromise API keys and credentials to hijack AI service access.
By utilizing containerized backdoors and custom Node.js proxies, threat actors can run unauthorized AI tasks or resell compute power.
The findings detail the operations of groups like UNC6993, which generated six-figure charges for victims.
To defend against this, teams should prioritize strict credential management and implement the principle of least privilege across AI-integrated workflows.
How the scam works
Fraudsters target companies that use AI tools. They gain access to their accounts using digital keys or exposed login credentials. Once they’re in, they use the company’s resources to perform their own AI tasks or to create services that they then resell.
Because AI models have high operating costs, charges can skyrocket in a matter of minutes, often reaching six figures. Google identified one particular group, called UNC6993, that managed to charge accounts over $100.000 in a matter of minutes.
An organized activity
According to Google, this scam is becoming an organized activity. Often, one group takes responsibility for the account breach, while another group specializes in reselling access to third parties. To avoid detection, the perpetrators constantly change accounts and use programs that hide the origin of their requests.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Five digital threats target organizations in the US: How they steal access to corporate accounts
↗
To protect against such attacks, Google recommends that companies closely monitor the use of artificial intelligence platforms and limit access rights, giving users only the capabilities that are absolutely necessary for their work.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)