# LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP Flaws Weaponized Within Days

> Mandiant and Google Threat Intelligence Group documented LLMjacking intrusions in which stolen cloud credentials and exposed API keys, plus LiteLLM CVE-2026-40217, produced fraudulent AI charges above $100,000 per day and up to $1 million per victim, resold through underground 'LLM Mixers' such as Jet Night. A SecurityWeek roundup of 2026-11-06 also reports a suspected cellular implant in a Trezor Safe 5 from reseller CryptoBilis, SAP exploitation windows of 1-3 days, and Greeter exploitation of Flowise CVE-2024-58351.

- **Published:** 2026-11-06T15:14:30Z
- **Last reviewed:** 2026-11-06T15:14:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5425
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5425.png
- **ID:** TL-2026-5425
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Actor:** UNC6993
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below)
- **CVEs:** CVE-2026-40217, CVE-2024-58351

## Description

LLMjacking is the hijacking of enterprise access to hosted LLMs so that the victim pays for attacker-driven inference. Mandiant and the Google Threat Intelligence Group (GTIG) published research on 2026-11-02/03 describing multiple incidents with fraudulent cloud charges above $100,000 per day and a maximum of roughly $1 million before access was revoked. Affected sectors were financial services, retail, technology and transportation across North America, South America and Asia Pacific. Reported initial access vectors were exposed or stolen cloud identity tokens, IAM credentials, service account keys, GitHub personal access tokens, active session tokens and LLM API keys. Attackers also scanned public LLM endpoints for vulnerabilities.

Post-compromise, the actors enumerated cloud services, code repositories and data stores for further credentials. They cloned codebases to look for hard-coded secrets, scanned logs, queried databases, and abused cloud identity permissions and VM configurations to escalate privilege. They created unauthorized IAM accounts, injected SSH keys, and deployed backdoor service accounts disguised as internal billing-optimization utilities. In one intrusion CVE-2026-40217, a LiteLLM flaw, was used to turn ordinary keys into full admin credentials. NVD describes it as remote code execution through bytecode rewriting at the /guardrails/test_custom_code endpoint (CVSS 8.8, CWE-94/CWE-420, affects LiteLLM through 2026-04-08, fixed in v1.83.10-stable). Reporting also describes publicly accessible reverse proxies and custom Node.js proxy bundles on victim infrastructure, and a 'burn and rotate' pattern of creating and deleting short-lived service accounts to evade rate limits. Request spikes above 1,000 requests per second and the absence of spend limits, audit logging and secret-manager monitoring were noted as enabling gaps.

Threat cluster UNC6993 breached a cloud instance through a misconfigured service account key. It hosted a session-hijacking page posing as an application portal that tricked users into pasting raw JSON access tokens, which bypassed password and MFA controls. It then created additional API keys to scale usage and accumulated over $100,000 in charges. A persona tracked as D1337-KAIROS used custom proxy bundles. Monetization is handled by 'LLM Mixers', illicit routing gateways that proxy, aggregate and resell unauthorized LLM access. Jet Night (jet-night.com) advertises an unlimited plan with claimed frontier-model access for about $60 a month, a price GTIG assesses is only viable on stolen keys; one actor made more than 500,000 API calls in under eight hours and one victim was left with nearly $1 million in token costs. newapi.pro was named as another mixer. A separate Symantec/Carbon Black finding cited by Google describes a grey-market relay that installs legitimate OpenAI Codex and Anthropic Claude Code CLIs and reconfigures them (~/.codex/config.toml, ~/.claude/settings.json) to route traffic through third-party infrastructure, using the lookalike domain vibe.aiok.me.

The SecurityWeek roundup bundles related items. Era researchers observed a Chinese-language exploitation framework, Greeter, hitting Flowise honeypots by abusing CVE-2024-58351 (overrideConfig injection leading to RCE, CVSS 9.8, fixed in Flowise 2.1.4). Era counted 4,372 exposed Flowise instances, 703 without authentication and 46 apparently vulnerable. Onapsis and Recorded Future report that the median time from SAP security note to verified exploitation fell to one to three days for 2025-2026 patches (489 days in 2021), with ransomware/extortion groups interested in SAP rising from 8 in 2023 to 26 in 2025 and SAP access listings priced at $500 to $30,000. Synology reported exploitation of a flaw patched in December 2024 (Synology-SA-24:20) against outdated DSM for ransomware-style extortion. Trezor reported a responsible-disclosure submission on 2026-10-28 alleging a Trezor Safe 5 bought in August 2026 from CryptoBilis, via Tokopedia, contained an extra board between the main board and screen with a cellular module and antenna that could capture the on-screen recovery phrase and transmit it over a mobile network. Trezor removed CryptoBilis as a reseller on 2026-10-09 and told buyers since March 2026 to move funds to a new wallet with a new seed. No stolen funds have been reported. The SecurityWeek item is secondary reporting. Technical detail here comes from the Google/Mandiant blog as summarized by BleepingComputer and The Hacker News, plus NVD and Trezor sources.

## MITRE ATT&CK

- T1078.004 Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1195.003 Compromise Hardware Supply Chain
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1213.003 Code Repositories
- T1136.003 Cloud Account
- T1098.004 SSH Authorized Keys
- T1090 Proxy
- T1583.001 Domains
- T1496.004 Cloud Service Hijacking
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Connections to LLM Mixer and Relay Infrastructure (jet-night.com, newapi.pro, vibe.aiok.me)** (`TL-2026-5425-SPL-003`)

Detects DNS lookups or proxy/firewall connections to infrastructure named in the Mandiant/GTIG LLMjacking reporting: the Jet Night token-routing storefront, the newapi.pro LLM mixer, and the vibe.aiok.me grey-market relay that reroutes Codex and Claude Code CLI traffic. Hits indicate hijacked LLM access being resold or consumed, or a relay-modified developer CLI.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1090, T1583.001, T1496.004
- **Data sources:** stream:dns, zscaler_web_proxy, bluecoat_proxysg, palo_alto_traffic
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
earliest=-24h ((index=dns sourcetype="stream:dns") OR (index=proxy (sourcetype="zscalernss-web" OR sourcetype="bluecoat:proxysg:access:syslog" OR sourcetype="pan:traffic")))
```comment: normalise DNS query and proxy URL host fields```
| eval host_name=lower(coalesce(query, url_domain, dest_host, dest_dns, url))
| where match(host_name, "(^|[./])(jet-night[.]com|newapi[.]pro|vibe[.]aiok[.]me)([:/]|$)")
| eval ioc=case(like(host_name,"%jet-night.com%"),"Jet Night LLM Mixer", like(host_name,"%newapi.pro%"),"newapi.pro LLM mixer", like(host_name,"%vibe.aiok.me%"),"vibe.aiok.me CLI relay", true(),"unknown")
| stats count AS events, values(sourcetype) AS sources, min(_time) AS first_seen, max(_time) AS last_seen BY src, host_name, ioc
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), threat_id="TL-2026-5425"
| table threat_id, ioc, host_name, src, events, sources, first_seen, last_seen
````

### Microsoft KQL

```kql
let llm_mixer_domains = dynamic(["jet-night.com", "newapi.pro", "vibe.aiok.me"]);
union isfuzzy=true
    (DeviceNetworkEvents
        | where Timestamp > ago(24h)
        | where RemoteUrl has_any (llm_mixer_domains)
        | project TimeGenerated = Timestamp, Source = "MDE", Device = DeviceName, User = InitiatingProcessAccountName, Process = InitiatingProcessFileName, Destination = RemoteUrl),
    (DnsEvents
        | where TimeGenerated > ago(24h)
        | where Name has_any (llm_mixer_domains)
        | project TimeGenerated, Source = "DNS", Device = Computer, User = "", Process = "", Destination = Name)
| order by TimeGenerated desc
```

### Sigma

```yaml
title: DNS Query to LLM Mixer and CLI Relay Domains
id: e4a09c37-1d52-4b86-a7f3-3c8b2d6e90f1
status: experimental
description: Detects DNS queries to jet-night.com, newapi.pro and vibe.aiok.me, infrastructure tied to LLMjacking monetization (LLM Mixers) and a grey-market relay that reroutes Codex and Claude Code CLI traffic through third-party servers.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models
    - https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.command-and-control
    - attack.t1090
    - attack.resource-development
    - attack.t1583.001
    - attack.impact
    - attack.t1496.004
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - 'jet-night.com'
            - 'newapi.pro'
            - 'vibe.aiok.me'
    condition: selection
falsepositives:
    - Threat-intelligence analysts or sandboxes deliberately resolving these domains
    - Security awareness material that links to the domains
level: high
```

**Known false positives:**

- Threat researchers or sandboxes deliberately resolving the domains
- Awareness or news content that links to the domains

**Tuning notes:** Adjust index and sourcetype names to your DNS and proxy sources. Add sibling domains as they are reported (no community-corroborated siblings were available from TL_OSINT_Scan at authoring time). Pair hits with endpoint telemetry to find the process and user, and block the domains at DNS and proxy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] and [indicator] Exploitation Attempts (CVE-2026-40217, CVE-2024-58351) (locked: unlock with TL Creds)
- GCP Persistence: SSH Key Injection, Disguised Billing Service Accounts and Burn-and-Rotate Churn (locked: unlock with TL Creds)
- LLM API Request Rate Spike Consistent with LLMjacking (1,000+ req/s, 500K+ Calls) (locked: unlock with TL Creds)
- Secret-Hunting Tools and API Key Grep Patterns on Hosts (LLMjacking Credential Harvesting) (locked: unlock with TL Creds)
- Grey-Market LLM Relay Installer Reconfiguring Codex and Claude Code CLIs (locked: unlock with TL Creds)
- Outbound Traffic to LLM Mixer Domains from Proxy and Firewall Logs (locked: unlock with TL Creds)
- [indicator] CVE-2026-40217 Exploitation via [indicator] (locked: unlock with TL Creds)
- Cloud Service Discovery Burst by Compromised Cloud Identity (LLMjacking Recon) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 14)

Defanged, TLP:CLEAR.

- Domain: `jet-night[.]com`
- Domain: `newapi[.]pro`
- Domain: `vibe[.]aiok[.]me`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [In Other News: Trezor Implant, LLMjacking Bills Hit $1M, SAP Flaws Weaponized Within Days](https://www.securityweek.com/in-other-news-trezor-implant-llmjacking-bills-hit-1m-sap-flaws-weaponized-within-days/)
- [Google Threat Intelligence / Mandiant: LLMjacking - Monetizing Compromised Cloud Models](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models)
- [Google: LLMjacking attacks rack up $1 million in cloud AI charges (BleepingComputer)](https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges/)
- [Google Warns LLMjacking Attacks Are Rising (The Hacker News)](https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html)
- [NVD: CVE-2026-40217 (LiteLLM)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-40217)
- [CVE-2026-40217: Remote Code Execution via Sandbox Escape in LiteLLM](https://dev.to/cverports/cve-2026-40217-cve-2026-40217-remote-code-execution-via-sandbox-escape-in-litellm-30ho)
- [NVD: CVE-2024-58351 (Flowise overrideConfig RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-58351)
- [Flowise GitHub Security Advisory GHSA-5cph-wvm9-45gj](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5cph-wvm9-45gj)
- [VulnCheck Advisory: Flowise RCE via overrideConfig](https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-overrideconfig-parameter)
- [Trezor: Implant reported in a Trezor sold by CryptoBilis](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis)
- [The Block: Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis](https://theblock.co/news/ecosystems/2026-10-30-trezor-reports-suspected-hardware-implant-432196)
- [BleepingComputer: Trezor warns of suspected crypto theft implant in hardware wallet](https://bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5425