The cryptocurrency industry has long known the term "cryptojacking" — the covert mining of digital assets using someone else's computing power. However, with the rapid growth of the generative artificial intelligence market, a new threat has emerged — LLMjacking. This is a scheme in which attackers gain unauthorized access to accounts of large language models (LLMs) and use them at the owner's expense.
The mechanics of the attack largely mirror classic cryptojacking. Hackers seek out vulnerable credentials — leaked API keys, weak passwords, compromised cloud configurations — and seize access to paid neural network services. The victim continues to pay the bills, unaware that their resources are being exploited by third parties.
Why it is profitable for attackers
The cost of queries to advanced models can be significant, and consumption volumes can be enormous. Criminals either resell access to stolen accounts or use them for their own purposes: generating content, bypassing paid limits, creating bots, and conducting automated attacks. The owner only learns of the problem upon receiving a bill or detecting anomalous activity in the logs.
Cryptalist's analysis notes a direct parallel with cryptojacking: in both cases, attackers monetize someone else's infrastructure while minimizing their own costs. The only difference is the target — previously it was GPUs for mining, now it is the computing resources of cloud AI platforms.
How to protect yourself
Key countermeasures include strict control of API keys, credential rotation, consumption monitoring, and setting spending limits. Organizations are advised to implement anomaly detection systems and access auditing for AI services, as well as promptly revoke compromised tokens.
Cryptalist analysis: As language models become integrated into corporate processes, LLMjacking will become as widespread a phenomenon as cryptojacking was during the peak mining years. The cybersecurity market in the AI segment will grow at an accelerated pace, and demand for spending control and API access protection tools will form a separate niche. Investors should view AI infrastructure security as a promising area with sustained long-term demand.