Fake LLM Portal Steals Access Tokens

Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command that rerouted legitimate coding assistants through third-party servers and disabled safety settings.

Key findings

• LLMjacking attackers steal or expose LLM API keys and cloud tokens, then consume costly AI resources while the victim pays the bill.
• Google observed individual incidents exceeding $100,000 in fraudulent charges in one day, with some organizations reaching $1 million before access was revoked.
• UNC6993 used a fake application portal to collect active LLM access tokens from users, bypassing password and MFA protections.
• A separate unauthorized relay service used legitimate OpenAI Codex and Anthropic Claude Code tools, then changed their configuration to route requests through third-party infrastructure.
• The relay setup reportedly relied on employees running a one-line command from a lookalike domain; the resulting script disabled sandbox protections, enabled network access, and disabled telemetry.

Who’s being targeted

• Commonly targeted roles: Developers, Software engineers, AI application users, Cloud administrators, IT support teams, Engineering managers, Finance and cloud-cost owners.
• Affected industries: Financial services, Retail, Technology, Transportation, Industrial automation, Electronics manufacturing, Semiconductors, Pharmaceuticals, Shipping, Tire manufacturing, Petrochemicals, Data center services.
• Attack channels: website.
• Impersonated: An application portal for a legitimate LLM service, An unauthorized AI coding-assistant reseller.

Awareness takeaways

• Never paste access tokens, API keys, or raw authentication data into a website that claims to help with account setup, invitations, or group access. Use only the official service workflow and verify unexpected requests with the service owner.
• Only install or configure AI developer tools using the vendor’s official documentation and domains. Treat a request to run a one-line command from a lookalike domain as suspicious.
• Do not accept setup instructions that disable security safeguards, sandboxing, logging, or error reporting, even when the underlying software appears legitimate.
• Protect cloud and AI-service credentials as financial assets: quickly report suspected token exposure because unauthorized LLM use can create very large charges within hours.

Red flags to watch for

• The portal requests a raw JSON payload containing an active access token.
• A website claiming to help users join a group asks for credentials or token material.
• The requested token can bypass normal password and MFA protections.
• The setup command is hosted on the lookalike domain vibe.aiok[.]me rather than the vendor’s official site.
• The command fetches a fileless PowerShell or bash script.
• The configuration disables sandboxing, enables network access, and disables telemetry and error reporting.