# Cybercriminals target LLM API keys in "LLMJacking" token resale scheme

> Original title: Happening everywhere: “The evidence indicates links to a financially motivated cybercriminal threat actor group that aims to sell tokens ...

- Source: Gergely Orosz
- Published: 2026-11-10T11:05:00.000Z
- Bad Influence: https://badinfluence.news/items/f5istvg3qa9grnuufq1wsfr7s
- Original: https://x.com/GergelyOrosz/status/2120110471026200781

## Summary

The post says evidence links a financially motivated cybercriminal group to "LLMJacking," which sells tokens from unauthorized access to LLMs to illicit routing gateways. It adds that any service storing AI keys is attacked nonstop.

## Post

Happening everywhere: “The evidence indicates links to a financially motivated cybercriminal threat actor group that aims to sell tokens from unauthorized access to LLMs to illicit routing gateways, known as "LLMJacking" “

Any service storing AI keys is attacked nonstop

## Quoted post @lqiao

> https://x.com/i/article/2119941730518937600

https://x.com/lqiao/status/2119943330612256890