Cybercriminals now resell stolen cloud access to LLMs as a subscription. Victims have paid up to $1 million in resource costs before access was revoked. Some incidents exceeded $100,000 in a single day. Attackers gain access via exposed endpoints or stolen API keys. They also use stolen cloud identity tokens or session tokens. Some attackers validate credentials with minimal API requests to stay undetected. LLM Mixers aggregate stolen credentials and sell access below market rates. These services route customer requests through victim environments. Google Threat Intelligence Group and Mandiant documented the trend. They observed coordinated attacks by multiple threat clusters. Defenders are advised to prioritize IAM and supply chain security.

• $1 million in resource consumption per victim
• $100,000 in a single day