Cybercriminals resell stolen LLM API keys in "LLMJacking" scheme

A financially motivated cybercriminal group is linked to "LLMJacking," a scheme that sells tokens obtained through unauthorized access to large language models to illicit routing gateways, according to a post by Gergely Orosz on X. The post says any service that stores AI keys is attacked continuously.

The report includes no named group, victim count, or supporting evidence beyond the post's own claim, and the fact record lists no subject, action, or conditions.