AI Infrastructure Becomes Prime Target for Cybercriminals as 'LLM-Jacking' Surges

Key points

• Google Threat Intelligence Group reports a major surge in 'LLM-jacking' attacks, where hackers steal and resell access to AI models from providers like OpenAI, Anthropic, and Google.
• Dark web marketplaces are selling these stolen AI credentials at discounts of up to 97%, with some sellers offering 'guaranteed access' replacements if accounts are blocked.
• Criminal and state-backed groups are also breaching corporate cloud servers to deploy their own AI models, effectively using victims' computing resources for free, similar to cryptocurrency mining.
• A separate supply-chain attack involving the LiteLLM framework in March 2026 potentially exposed credentials for over 2,500 organizations, including major tech firms, highlighting the vulnerability of AI dependencies.
• Security experts warn that the low cost of stolen AI resources creates an economic asymmetry, allowing attackers to operate more efficiently than defenders who must pay full price for AI tools.

Background

This development follows a broader trend of AI integration in enterprise environments, as seen in recent reports of surging AI server demand and increased AI-related job listings. Earlier in 2026, incidents such as the Iranian-linked cyberattack on a UK power generator highlighted the growing threat of state-backed cyber operations, while the LiteLLM supply-chain attack exposed the risks of compromised AI dependencies in enterprise software.

How outlets are covering it

The Financial Times and Futu News emphasize the economic aspect of 'LLM-jacking,' highlighting the cost advantage attackers gain from cheap AI access. CX Today focuses on the supply-chain dimension, detailing the LiteLLM attack and its potential impact on major enterprises. NordVPN provides a broader perspective on 'dark AI,' explaining how AI tools are being used for various malicious activities, including phishing and deepfakes, but does not specifically address the 'LLM-jacking' phenomenon.

Why it matters

The rise of 'LLM-jacking' and related cybercrimes poses a significant threat to organizations relying on AI, as attackers can leverage stolen resources to conduct more sophisticated and cost-effective attacks. This trend underscores the need for robust security measures to protect AI infrastructure and credentials, as the potential impact extends beyond individual systems to enterprise-wide operations.

What to watch

Security experts expect continued growth in AI-targeted cybercrimes as more organizations adopt AI. Companies are likely to increase investment in securing AI infrastructure, including credential rotation, dependency governance, and runtime monitoring. Regulatory bodies may also develop new frameworks to address AI-specific security risks, as seen in the FBI's recent advisory on supply-chain attacks.