FlagThis — Daily Cybersecurity Intelligence Briefing

Threat actors are executing LLMjacking campaigns to compromise Google Cloud Vertex AI API keys and service account credentials. Initial access vectors include phishing, hardcoded keys in leaked source repositories, misconfigured cloud storage, exposed environment variables, and client-side code exposure. Attackers fraudulently invoke Vertex AI LLM APIs to consume GPU/TPU compute resources. Mandiant investigated 2026 incidents exceeding $100,000 in daily fraudulent cloud charges, with total bills approaching $1 million per victim organization.