Activity timeline
T1496.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1496.004 Cloud Service Hijacking is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of T1496 Resource Hijacking. Threadlinqs maps 10 of 3664 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high.
Threats that use T1496.004 most often also use T1078.004 Cloud Accounts (8 threats), T1552.001 Credentials In Files (7 threats), T1528 Steal Application Access Token (6 threats), T1539 Steal Web Session Cookie (5 threats), T1190 Exploit Public-Facing Application (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1496.004; the most frequent are UNC6993 (2).
Threat actors using it
Tracked threats
10 tracked threats use T1496.004.
- LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP…high
- The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS…high
- Infostealer-Driven Claude AI Session Hijacking via Stolen Browser Cookies (Vidar, LummaC2, StealC, RedLine…high
- LiteLLM Supply Chain Compromise (litellm 1.107.0) Targets AI Developer Credentialscritical
- Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attackshigh
- From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usagehigh
- OpenCode Console breach exposes linked AI-provider API keys amid large-scale distillation attackhigh
- Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)high
- Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)high
- Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)high
Detection coverage
Threadlinqs maintains 22 detection rules mapped to T1496.004 (SPL 8, KQL 10, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1496 Resource Hijacking — 174 tracked threats at the technique level.