Key takeaway
Two reports published within a day of each other describe the same structural shift: attackers no longer need bespoke tooling per target, because a middle layer now aggregates access, credentials and capability, and sells it onward. Your detection strategy has to cover that layer, not just the endpoints.
What happened
Google Threat Intelligence Group and Mandiant published research this week on LLMjacking, the practice of stealing enterprise access to large language models and letting the victim pay for the consumption. The headline numbers are billing figures rather than dwell time: fraudulent charges exceeding $100,000 in a single day in individual incidents, and cumulative charges at some organisations reaching $1 million before access was revoked. Affected entities span financial services, retail, technology and transportation across North America, South America and Asia Pacific. The initial access patterns will look familiar to anyone who has worked a cloud intrusion. Google names exposed or stolen cloud identity tokens as the most common vector — IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One tracked cluster, UNC6993, entered through a misconfigured service account key, then ran a session-hijacking page disguised as an application portal that convinced users to paste a raw JSON payload containing a live access token, which the operators replayed against the backend API to sidestep password and MFA controls. From there the playbook is enumeration of code repositories, data stores and secret managers, cloning of sensitive codebases to grep for hard-coded secrets, scanning of access logs for credentials belonging to secondary cloud environments, creation of unauthorised IAM and service accounts, SSH key injection into compute instances, and exploitation of model-routing middleware — including CVE-2026-40217 in LiteLLM — for privilege escalation.
Jet Night and the LLM Mixer resale tier
What makes this cycle different from earlier resource-theft reporting is the emergence of what Google calls LLM Mixers: illicit routing gateways that proxy, aggregate and resell unauthorised model access through underground storefronts. The report names Jet Night (jet-night[.]com), which advertises an unlimited token plan against an allegedly frontier model for roughly $60 per month. The mixer takes the risk of holding the stolen quota; the buyer takes a cheap subscription. Google also notes a burn-and-rotate pattern in which operators continuously create and delete short-lived service accounts to evade rate limits. A parallel finding from Symantec and Carbon Black, cited in the same reporting, describes a grey-market relay that does not distribute modified client software at all. It installs the genuine OpenAI Codex or Anthropic Claude Code CLI via npm, then instructs the user to run a one-line command that fetches a fileless PowerShell or bash setup script from a lookalike domain. That script rewrites ~/.codex/config.toml or ~/.claude/settings.json to disable the execution sandbox, enable network access for the write sandbox, swap in relay-issued tokens in place of the user's credentials, and switch off telemetry and error reporting. The service is assessed active since at least early 2026, affecting roughly a dozen organisations in mainland China plus multinational subsidiaries in South Korea, Taiwan and Malaysia. Separately, BleepingComputer reported that an open-source, multi-agent AI penetration-testing framework called ARTEX was used in attacks against more than 200 organisations across 14 countries. That reporting is a summary-level account; the technical internals of the framework and the identity of the operators have not been independently verified here.
Why it matters
The common thread is not a vulnerability. It is an architectural position. An aggregation layer sits inside the identity boundary, holds credentials with broad read scope, and produces traffic that looks like sanctioned developer behaviour. A mixer converts one compromised token into recurring revenue; a relay converts a legitimate binary into an exfiltration path; an agent framework converts commodity open-source tooling into a repeatable campaign against hundreds of targets. This inverts the usual detection economics. Signature-based controls have nothing to match on, because the Codex and Claude Code executables are authentic and correctly signed. Network controls see requests going to a real CLI talking to a real endpoint — just not the vendor's endpoint. EDR sees an npm install and a shell one-liner, which is indistinguishable from a hundred legitimate onboarding procedures. In the mixer case the first hard signal is often the invoice.
Why the CLI relay is harder to see than a trojanised binary
Trojanised installers give defenders something to hate: a hash, a dropped file, a persistence mechanism. The relay avoids all three. Its footprint is configuration state — a flipped sandbox flag, a replaced token, telemetry set to false — and configuration drift is rarely baselined with the same rigour as binaries. The locale check the setup script performs on Windows systems also means the payload deliberately does nothing in most of the environments where it is being analysed, which is worth remembering when reproducing samples in a European lab. If your threat-intelligence pipeline aggregates vendor reports into a platform for triage, the practical consequence is that this class of activity generates almost no indicators. Enrichment against hash and domain feeds will surface the lookalike domain, but the meaningful queries are identity- and configuration-based, which most CTI platforms are not the system of record for.
What defenders should do
Start with service account behaviour in cloud audit logs. Query for creation events where the same principal creates and deletes accounts repeatedly within short windows — the burn-and-rotate shape — and for any service account whose name or description references billing, cost optimisation or internal utilities that your platform team cannot confirm it owns. Review which principals hold token-creation rights such as roles/iam.serviceAccountTokenCreator, and treat any token minted for a high-privilege service account by an unusual user agent or from an unfamiliar region as an incident rather than a misconfiguration.
Hunting the burn-and-rotate pattern in Cloud Audit Logs
Build the query as a sequence rather than a match: account creation followed by key creation followed by deletion, grouped by the creating principal over a 24-hour window, then ranked by count. Add a second pass that joins GenerateAccessToken and similar token-minting calls to the calling user agent string, and flag any agent that is not your sanctioned SDKs or CI runners. For exposed LLM endpoints, inventory is the prerequisite — crawl your cloud projects for model endpoints and API keys with public reachability before you can reason about who is consuming them. On the endpoint side, baseline the two configuration files named in the Symantec reporting. Alert on ~/.codex/config.toml or ~/.claude/settings.json containing a disabled sandbox, telemetry disabled, or a token that does not match the value your MDM or credential broker issued. Correlate with the preceding process chain: an npm install of the CLI within the last hour, followed by a shell one-liner fetching from a domain that is not npmjs.com. In environments where developers use these tools, a weekly configuration hash comparison is cheaper than an incident. Finally, treat cloud spend as a detection source with the same seriousness as authentication logs. Per-project budget alerts tuned to daily rather than monthly thresholds will catch LLMjacking faster than most log-based rules, and they worked in the incidents Google describes — in one case only after six figures had already accumulated. Patch or inventory LiteLLM against CVE-2026-40217, and restrict which users can deploy model-routing middleware that terminates credentials. If your team still relies on open-source recon and enrichment tooling chained together by scripts, audit what those scripts can reach; ARTEX, whatever its internals, is a reminder that the tooling bar for running campaigns against hundreds of targets is now very low.