LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP Flaws Weaponized Within Days

Key facts for Jet Night LLM Mixers

Detection coverage for Jet Night LLM Mixers

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5425 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Connections to LLM Mixer and Relay Infrastructure (jet-night.com, newapi.pro, vibe.aiok.me)

Detects DNS lookups or proxy/firewall connections to infrastructure named in the Mandiant/GTIG LLMjacking reporting: the Jet Night token-routing storefront, the newapi.pro LLM mixer, and the vibe.aiok.me grey-market relay that reroutes Codex and Claude Code CLI traffic. Hits indicate hijacked LLM access being resold or consumed, or a relay-modified developer CLI.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1090, T1583.001, T1496.004
• Data sources: stream:dns, zscaler_web_proxy, bluecoat_proxysg, palo_alto_traffic
• Severity: high
• Confidence: high

Splunk SPL

earliest=-24h ((index=dns sourcetype="stream:dns") OR (index=proxy (sourcetype="zscalernss-web" OR sourcetype="bluecoat:proxysg:access:syslog" OR sourcetype="pan:traffic")))
```comment: normalise DNS query and proxy URL host fields```
| eval host_name=lower(coalesce(query, url_domain, dest_host, dest_dns, url))
| where match(host_name, "(^|[./])(jet-night[.]com|newapi[.]pro|vibe[.]aiok[.]me)([:/]|$)")
| eval ioc=case(like(host_name,"%jet-night.com%"),"Jet Night LLM Mixer", like(host_name,"%newapi.pro%"),"newapi.pro LLM mixer", like(host_name,"%vibe.aiok.me%"),"vibe.aiok.me CLI relay", true(),"unknown")
| stats count AS events, values(sourcetype) AS sources, min(_time) AS first_seen, max(_time) AS last_seen BY src, host_name, ioc
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), threat_id="TL-2026-5425"
| table threat_id, ioc, host_name, src, events, sources, first_seen, last_seen

Microsoft KQL

let llm_mixer_domains = dynamic(["jet-night.com", "newapi.pro", "vibe.aiok.me"]);
union isfuzzy=true
    (DeviceNetworkEvents
        | where Timestamp > ago(24h)
        | where RemoteUrl has_any (llm_mixer_domains)
        | project TimeGenerated = Timestamp, Source = "MDE", Device = DeviceName, User = InitiatingProcessAccountName, Process = InitiatingProcessFileName, Destination = RemoteUrl),
    (DnsEvents
        | where TimeGenerated > ago(24h)
        | where Name has_any (llm_mixer_domains)
        | project TimeGenerated, Source = "DNS", Device = Computer, User = "", Process = "", Destination = Name)
| order by TimeGenerated desc

Sigma

title: DNS Query to LLM Mixer and CLI Relay Domains
id: e4a09c37-1d52-4b86-a7f3-3c8b2d6e90f1
status: experimental
description: Detects DNS queries to jet-night.com, newapi.pro and vibe.aiok.me, infrastructure tied to LLMjacking monetization (LLM Mixers) and a grey-market relay that reroutes Codex and Claude Code CLI traffic through third-party servers.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models
    - https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.command-and-control
    - attack.t1090
    - attack.resource-development
    - attack.t1583.001
    - attack.impact
    - attack.t1496.004
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - 'jet-night.com'
            - 'newapi.pro'
            - 'vibe.aiok.me'
    condition: selection
falsepositives:
    - Threat-intelligence analysts or sandboxes deliberately resolving these domains
    - Security awareness material that links to the domains
level: high

Known false positives:

• Threat researchers or sandboxes deliberately resolving the domains
• Awareness or news content that links to the domains

Tuning notes: Adjust index and sourcetype names to your DNS and proxy sources. Add sibling domains as they are reported (no community-corroborated siblings were available from TL_OSINT_Scan at authoring time). Pair hits with endpoint telemetry to find the process and user, and block the domains at DNS and proxy.

• 🔒 [indicator] and [indicator] Exploitation Attempts (CVE-2026-40217, CVE-2024-58351) · unlock with TL Creds
• 🔒 GCP Persistence: SSH Key Injection, Disguised Billing Service Accounts and Burn-and-Rotate Churn · unlock with TL Creds
• 🔒 LLM API Request Rate Spike Consistent with LLMjacking (1,000+ req/s, 500K+ Calls) · unlock with TL Creds
• 🔒 Secret-Hunting Tools and API Key Grep Patterns on Hosts (LLMjacking Credential Harvesting) · unlock with TL Creds
• 🔒 Grey-Market LLM Relay Installer Reconfiguring Codex and Claude Code CLIs · unlock with TL Creds
• 🔒 Outbound Traffic to LLM Mixer Domains from Proxy and Firewall Logs · unlock with TL Creds
• 🔒 [indicator] CVE-2026-40217 Exploitation via [indicator] · unlock with TL Creds
• 🔒 Cloud Service Discovery Burst by Compromised Cloud Identity (LLMjacking Recon) · unlock with TL Creds

Indicators of compromise for Jet Night LLM Mixers

As of 2026-11-06, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5425.

Sample indicators (3 of 14)

• Domain: jet-night[.]com
• Domain: newapi[.]pro
• Domain: vibe[.]aiok[.]me

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

How Jet Night LLM Mixers works

A SecurityWeek roundup of 2026-11-06 also reports a suspected cellular implant in a Trezor Safe 5 from reseller CryptoBilis, SAP exploitation windows of 1-3 days, and Greeter exploitation of Flowise CVE-2024-58351.

LLMjacking is the hijacking of enterprise access to hosted LLMs so that the victim pays for attacker-driven inference. Mandiant and the Google Threat Intelligence Group (GTIG) published research on 2026-11-02/03 describing multiple incidents with fraudulent cloud charges above $100,000 per day and a maximum of roughly $1 million before access was revoked. Affected sectors were financial services, retail, technology and transportation across North America, South America and Asia Pacific. Reported initial access vectors were exposed or stolen cloud identity tokens, IAM credentials, service account keys, GitHub personal access tokens, active session tokens and LLM API keys. Attackers also scanned public LLM endpoints for vulnerabilities.

Post-compromise, the actors enumerated cloud services, code repositories and data stores for further credentials. They cloned codebases to look for hard-coded secrets, scanned logs, queried databases, and abused cloud identity permissions and VM configurations to escalate privilege. They created unauthorized IAM accounts, injected SSH keys, and deployed backdoor service accounts disguised as internal billing-optimization utilities. In one intrusion CVE-2026-40217, a LiteLLM flaw, was used to turn ordinary keys into full admin credentials. NVD describes it as remote code execution through bytecode rewriting at the /guardrails/test_custom_code endpoint (CVSS 8.8, CWE-94/CWE-420, affects LiteLLM through 2026-04-08, fixed in v1.83.10-stable). Reporting also describes publicly accessible reverse proxies and custom Node.js proxy bundles on victim infrastructure, and a 'burn and rotate' pattern of creating and deleting short-lived service accounts to evade rate limits. Request spikes above 1,000 requests per second and the absence of spend limits, audit logging and secret-manager monitoring were noted as enabling gaps.

Threat cluster UNC6993 breached a cloud instance through a misconfigured service account key. It hosted a session-hijacking page posing as an application portal that tricked users into pasting raw JSON access tokens, which bypassed password and MFA controls. It then created additional API keys to scale usage and accumulated over $100,000 in charges. A persona tracked as D1337-KAIROS used custom proxy bundles. Monetization is handled by 'LLM Mixers', illicit routing gateways that proxy, aggregate and resell unauthorized LLM access. Jet Night (jet-night.com) advertises an unlimited plan with claimed frontier-model access for about $60 a month, a price GTIG assesses is only viable on stolen keys; one actor made more than 500,000 API calls in under eight hours and one victim was left with nearly $1 million in token costs. newapi.pro was named as another mixer. A separate Symantec/Carbon Black finding cited by Google describes a grey-market relay that installs legitimate OpenAI Codex and Anthropic Claude Code CLIs and reconfigures them (~/.codex/config.toml, ~/.claude/settings.json) to route traffic through third-party infrastructure, using the lookalike domain vibe.aiok.me.

The SecurityWeek roundup bundles related items. Era researchers observed a Chinese-language exploitation framework, Greeter, hitting Flowise honeypots by abusing CVE-2024-58351 (overrideConfig injection leading to RCE, CVSS 9.8, fixed in Flowise 2.1.4). Era counted 4,372 exposed Flowise instances, 703 without authentication and 46 apparently vulnerable. Onapsis and Recorded Future report that the median time from SAP security note to verified exploitation fell to one to three days for 2025-2026 patches (489 days in 2021), with ransomware/extortion groups interested in SAP rising from 8 in 2023 to 26 in 2025 and SAP access listings priced at $500 to $30,000. Synology reported exploitation of a flaw patched in December 2024 (Synology-SA-24:20) against outdated DSM for ransomware-style extortion. Trezor reported a responsible-disclosure submission on 2026-10-28 alleging a Trezor Safe 5 bought in August 2026 from CryptoBilis, via Tokopedia, contained an extra board between the main board and screen with a cellular module and antenna that could capture the on-screen recovery phrase and transmit it over a mobile network. Trezor removed CryptoBilis as a reseller on 2026-10-09 and told buyers since March 2026 to move funds to a new wallet with a new seed. No stolen funds have been reported. The SecurityWeek item is secondary reporting. Technical detail here comes from the Google/Mandiant blog as summarized by BleepingComputer and The Hacker News, plus NVD and Trezor sources.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195.003 Compromise Hardware Supply Chain

Command and Control

T1090 Proxy

Persistence

T1098.004 SSH Authorized Keys; T1136.003 Cloud Account

Collection

T1213.003 Code Repositories

Impact

T1496.004 Cloud Service Hijacking; T1657 Financial Theft

Discovery

T1526 Cloud Service Discovery

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files

Resource Development

T1583.001 Domains

Remediation for Jet Night LLM Mixers

Patches

• Upgrade LiteLLM to v1.83.10-stable or later (CVE-2026-40217)
• Upgrade Flowise to 2.1.4 or later (CVE-2024-58351)
• Apply Synology DSM update per Synology-SA-24:20

Immediate actions

• Revoke and rotate exposed cloud IAM credentials, service account keys, GitHub PATs, session tokens and LLM API keys
• Set hard budget caps and billing-anomaly alerts on LLM and cloud AI services
• Audit IAM for unauthorized accounts, backdoor service accounts and injected SSH keys
• Block jet-night.com, newapi.pro and vibe.aiok.me at DNS and proxy
• Trezor buyers from CryptoBilis since March 2026: move funds to a new wallet with a new seed

Workarounds

• Disable or block /guardrails/test_custom_code on LiteLLM until patched
• Disable the Flowise overrideConfig feature or strip the parameter at an API gateway

Longer-term hardening

• Scan repositories, logs and secret managers for hard-coded credentials
• Enable MFA with token protection and enforce least privilege on LLM service accounts
• Keep cloud audit logging enabled and monitor request-rate spikes against LLM endpoints
• Do not expose LLM gateways and AI workflow tools (LiteLLM, Flowise) to the internet without authentication
• Shorten SAP patch windows given 1-3 day median time to exploitation

Affected and fixed versions

• BerriAI — LiteLLM
  Vulnerable versions: through 2026-04-08
  Fixed in: v1.83.10-stable
• FlowiseAI — Flowise
  Vulnerable versions: before 2.1.4
  Fixed in: 2.1.4
• Various — Cloud-hosted LLM services and exposed LLM API keys
  Vulnerable versions: accounts with exposed or stolen credentials and no spend limits
• Trezor — Trezor Safe 5 (units from reseller CryptoBilis)
  Vulnerable versions: units purchased from CryptoBilis since March 2026

Timeline of Jet Night LLM Mixers

• 2026-03-01 locked-ioc-7 begins operating as an authorized Trezor reseller in Southeast Asia; Trezor later advises all buyers from March 2026 onward to migrate funds (exact day in March not stated).
• 2026-04-08 locked-ioc-13 releases through 2026-04-08 are affected by CVE-2026-40217 (unauthenticated-path code execution via locked-ioc-1).
• 2026-04-10 CVE-2026-40217 published in NVD (CVSS 8.8); fixed in locked-ioc-13 v1.83.10-stable.
• 2026-06-20 CVE-2024-58351 (locked-ioc-14 before 2.1.4, overrideConfig RCE, CVSS 9.8) published in NVD.
• 2026-08-01 The Trezor Safe 5 later reported as implanted is bought from locked-ioc-7 via locked-ioc-10 (month stated as August 2026; day not stated).
• 2026-10-09 Trezor removes locked-ioc-7 as an authorized reseller and begins investigating customer devices.
• 2026-10-28 Trezor's security team receives a responsible-disclosure report of a cellular-module implant inside a Safe 5.
• 2026-10-30 Trezor publicly warns of the suspected implant and offers replacements or vouchers to locked-ioc-7 buyers since March 2026; no stolen funds reported.
• 2026-11-02 Mandiant and GTIG publish LLMjacking research: $100,000+/day fraudulent charges, up to ~$1M per victim, CVE-2026-40217 abuse, locked-ioc-11, and the LLM Mixer ecosystem (locked-ioc-9). The Hacker News dates the report 2026-11-03.
• 2026-11-06 SecurityWeek roundup reports LLMjacking, Trezor implant, SAP 1-3 day exploitation window, locked-ioc-12 attacks on locked-ioc-14 and Synology DSM exploitation.

Sources cited for Jet Night LLM Mixers

• NVD: CVE-2026-40217 (LiteLLM) NVD (NIST) · Advisory · 2026-04-10
• NVD: CVE-2024-58351 (Flowise overrideConfig RCE) NVD (NIST) · Advisory · 2026-06-20
• VulnCheck Advisory: Flowise RCE via overrideConfig vulncheck.com · Advisory
• Google Threat Intelligence / Mandiant: LLMjacking - Monetizing Compromised Cloud Models Google Cloud · Vendor report · 2026-11-02
• CVE-2026-40217: Remote Code Execution via Sandbox Escape in LiteLLM dev.to · Research
• Trezor: Implant reported in a Trezor sold by CryptoBilis trezor.io · Vendor report · 2026-10-30
• Flowise GitHub Security Advisory GHSA-5cph-wvm9-45gj GitHub · Code repository
• In Other News: Trezor Implant, LLMjacking Bills Hit $1M, SAP Flaws Weaponized Within Days SecurityWeek · News · 2026-11-06
• Google: LLMjacking attacks rack up $1 million in cloud AI charges (BleepingComputer) BleepingComputer · News · 2026-11-02
• Google Warns LLMjacking Attacks Are Rising (The Hacker News) The Hacker News · News · 2026-11-03
• The Block: Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis theblock.co · News · 2026-10-30
• BleepingComputer: Trezor warns of suspected crypto theft implant in hardware wallet BleepingComputer · News

More in cloud

• Key Eater: Stolen Microsoft Entra ID Application Credentials Used to Breach 27 Organizations
• The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)
• Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
• From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage
• AWS EKS Forensics: Data Sources and Investigation Tooling (Synacktiv)