# T1496.004 Cloud Service Hijacking

> As of 2026-11-06, T1496.004 (Cloud Service Hijacking) appears in 10 tracked threats, first reported 2026-09-05 and most recently 2026-11-06, with linked actors including UNC6993; it most often appears alongside T1078.004 (Cloud Accounts).

- **Tracked threats:** 10 (1 critical, 9 high)
- **First seen:** 2026-09-05
- **Last seen:** 2026-11-06
- **Threat actors:** 1
- **Detection rules:** 22 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1496.004
- **Framework:** MITRE ATT&CK
- **Tactics:** Impact
- **Matrix:** Enterprise
- **Parent:** T1496
- **Data as of:** 2026-11-06
- **MITRE:** https://attack.mitre.org/techniques/T1496/004/

## Activity timeline

T1496.004 first appeared in tracked threats on 2026-09-05 and was most recently reported on 2026-11-06. The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1496.004 Cloud Service Hijacking is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of [T1496 Resource Hijacking](https://intel.threadlinqs.com/technique/T1496). Threadlinqs maps 10 of 3664 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high.

Threats that use T1496.004 most often also use [T1078.004 Cloud Accounts](https://intel.threadlinqs.com/technique/T1078.004) (8 threats), [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (7 threats), [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (6 threats), [T1539 Steal Web Session Cookie](https://intel.threadlinqs.com/technique/T1539) (5 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1496.004; the most frequent are [UNC6993](https://intel.threadlinqs.com/actor/UNC6993) (2).

## Threat actors using it

- [UNC6993](https://intel.threadlinqs.com/actor/UNC6993) — 2

## Tracked threats

10 tracked threats use T1496.004.

- [LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP…](https://intel.threadlinqs.com/threat/TL-2026-5425) — high — 2026-11-06
- [The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS…](https://intel.threadlinqs.com/threat/TL-2026-5064) — high — 2026-11-02
- [Infostealer-Driven Claude AI Session Hijacking via Stolen Browser Cookies (Vidar, LummaC2, StealC, RedLine…](https://intel.threadlinqs.com/threat/TL-2026-4533) — high — 2026-10-27
- [LiteLLM Supply Chain Compromise (litellm 1.107.0) Targets AI Developer Credentials](https://intel.threadlinqs.com/threat/TL-2026-4326) — critical — 2026-10-24
- [Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks](https://intel.threadlinqs.com/threat/TL-2026-4030) — high — 2026-10-21
- [From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage](https://intel.threadlinqs.com/threat/TL-2026-3987) — high — 2026-10-20
- [OpenCode Console breach exposes linked AI-provider API keys amid large-scale distillation attack](https://intel.threadlinqs.com/threat/TL-2026-3942) — high — 2026-10-20
- [Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)](https://intel.threadlinqs.com/threat/TL-2026-2757) — high — 2026-09-28
- [Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)](https://intel.threadlinqs.com/threat/TL-2026-2752) — high — 2026-09-28
- [Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)](https://intel.threadlinqs.com/threat/TL-2026-2341) — high — 2026-09-05

## Related CVEs

CVEs referenced by the tracked threats that use T1496.004, most frequent first.

- [CVE-2026-40217](https://intel.threadlinqs.com/cve/CVE-2026-40217)
- [CVE-2026-47101](https://intel.threadlinqs.com/cve/CVE-2026-47101)
- [CVE-2026-47102](https://intel.threadlinqs.com/cve/CVE-2026-47102)

## Detection coverage

Threadlinqs maintains 22 detection rules mapped to T1496.004 (SPL 8, KQL 10, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only.

22 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Parent technique

[T1496 Resource Hijacking](https://intel.threadlinqs.com/technique/T1496) — 174 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1496.004
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp