Google Warns of LLMjacking Campaigns Costing Enterprises Up to $1 Million in Fraudulent Cloud Charges

On November 3, 2026, Google Cloud Security Team warned that threat actors are conducting LLMjacking attacks targeting enterprise access to Large Language Models. The tactic, described as a form of resource hijacking adapted for the LLM era, involves attackers obtaining API keys through various means including phishing campaigns, source code leaks, misconfigured cloud environments, and exposed client-side code. Once in possession of valid API keys, actors use the victim's cloud account to run expensive LLM computing workloads, resulting in fraudulent cloud charges that can reach up to $1 million per enterprise. Google notes that the attack does not exploit a software vulnerability but rather leverages stolen credentials and misconfigurations. The company has advised affected organizations to rotate compromised API keys immediately, enforce strict Identity and Access Management (IAM) policies, monitor for unusual LLM usage patterns, and employ API gateways with rate limiting and anomaly detection capabilities. Google also recommends reviewing source code for accidentally exposed credentials and educating users about phishing risks targeting AI service credentials.