---
title: "CFOs face “LLMjacking” fraud as stolen AI credentials generate million-dollar cloud bills"
slug: "cfos-face-llmjacking-fraud-as-stolen-ai-credentials-generate-million-d"
date: "2026-11-05"
category: "FinTech"
author: "Tariq Al-Mansoor"
correspondent: "Tariq Al-Mansoor"
correspondentRole: "Gulf & Capital Correspondent"
readingTimeMinutes: 1
tags: ["Fintech","News"]
originalSourceUrl: "https://www.pymnts.com/news/artificial-intelligence/2026/the-cfos-guide-to-llmjacking-when-stolen-ai-becomes-a-7-figure-cloud-bill/"
canonicalUrl: "https://aurav.ae/cfos-face-llmjacking-fraud-as-stolen-ai-credentials-generate-million-d"
publisher: "Aura-V Intelligence (aurav.ae)"
---

# CFOs face “LLMjacking” fraud as stolen AI credentials generate million-dollar cloud bills

> Cybercriminals are hijacking corporate AI accounts to run costly large-language-model queries, creating seven-figure cloud charges before detection.

## Key Takeaways (TL;DR)

- Google reports LLMjacking incidents where daily AI usage fraud exceeded $100,000, with some firms hit with $1 million before access was cut.
- Attackers exploit exposed API keys and service-account tokens, reselling access through services like Jet Night at $60 per month.
- CFOs must extend expense controls to API credentials and usage quotas to prevent unauthorised AI spend.

A Google cyber-threat intelligence report released on Monday, Nov. 2, details a new fraud vector dubbed “LLMjacking,” where stolen corporate AI credentials are used to generate massive cloud charges [Google report](https://www.pymnts.com/news/artificial-intelligence/2026/the-cfos-guide-to-llmjacking-when-stolen-ai-becomes-a-7-figure-cloud-bill/). Incidents recorded daily AI spend over $100,000, and cumulative costs at some organisations topped $1 million before the compromised access was revoked.

The scheme has hit firms in financial services, retail, technology and transportation across several continents. One reseller, Jet Night, advertised unlimited frontier-model access for roughly $60 a month and was linked to more than 500,000 API calls in under eight hours, costing the victim close to $1 million in token fees.

Because cloud platforms bill any authenticated request, successful authentication does not guarantee business approval. The fraud therefore exploits a gap between technical authentication and financial authorization, prompting CFOs to enforce controls at the level of service accounts, API keys and usage quotas rather than relying solely on purchase orders. Google predicts the criminal marketplace for stolen AI access will grow as premium models become more widely deployed.

---

*Original Think-Tank Source: [The CFO’s Guide to LLMjacking: When Stolen AI Becomes a 7-Figure Cloud Bill](https://www.pymnts.com/news/artificial-intelligence/2026/the-cfos-guide-to-llmjacking-when-stolen-ai-becomes-a-7-figure-cloud-bill/)*