Attackers who break into corporate cloud accounts are not stealing storage or mining coins. They are switching on AI services and selling the tokens, and the invoice lands on the victim.
Google Threat Intelligence Group and Mandiant published findings this week from several 2026 intrusions across finance, retail, technology and transport. Fraudulent charges passed $100,000 in a single day in some cases, and total exposure reached $1M at organizations before credentials were revoked.
Two kinds of criminal, one supply chain
One cluster handles the break-in. Another runs what the researchers call LLM Mixers, gateways that aggregate stolen access and resell it to paying subscribers underground.
One service, Jet Night, advertises an unlimited plan near $60 a month. A legitimate subscription to comparable models runs $100 to $250, so the price only works with lifted keys. A single feeder account made more than 500,000 model calls inside eight hours, and the victim’s token bill approached $1M.
The quiet part is the entry point
Most of the initial access was stolen cloud credentials: service account keys, GitHub tokens, live session tokens. In several incidents the AI services had been dormant, and the intruders turned them on themselves.
One group tracked as UNC6993 ran a fake user portal that coaxed visitors into pasting an active token. Another used CVE-2026-40217 in a LiteLLM gateway to promote an ordinary access key into an administrator credential.
Cryptojacking burned capacity slowly. This burns budget in hours, and the resale market lets the operator cash out while the bill posts elsewhere. The practical control is boring: inventory which AI services are live, and alert when one wakes up.
