Threat Intelligence

LLMJacking Becomes a Profitable Business for Cybercriminals, With Victims Facing Huge Cloud Bills

Dark Reading · 4 Nov 2026

Key Takeaway Set billing alerts and usage limits on your cloud AI accounts, and revoke unused access promptly, so unauthorised activity is spotted before it becomes a costly surprise.

Cybercriminals have found a new way to make money: reselling access to cloud-hosted large language models (LLMs), the technology behind many AI tools. This activity, known as LLMjacking, has grown into a thriving criminal enterprise, according to Dark Reading.

The victims are the organisations whose cloud accounts are being used. Some have faced as much as $1 million in resource consumption before the unauthorised access was revoked. That shows how quickly costs can build when someone else is running AI workloads on your account without your knowledge.

The source summary does not detail how the access is obtained or how the resale operates. However, the financial impact it describes is a clear warning for any business that uses cloud AI services. Unexpected usage can turn into a very large bill before anyone notices, so cost and access monitoring matter as much as traditional security controls.

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.