Fake LLM Portal Steals Tokens and Bypasses MFA

How the Attack Worked

In this incident, the threat actor tracked as UNC6993 built a fake application portal that impersonated a legitimate workflow for joining a group of LLM users. The portal's opening line invited targets to join a group of LLM users, then directed them to navigate to the legitimate LLM service website and copy a raw JSON payload containing an active access token. That token was then submitted to the attacker's backend API, which allowed the attacker to bypass password and multifactor authentication controls entirely. Because the token itself represented an already authenticated session, normal login protections never came into play.

Why It Succeeded

The attack succeeded because it did not ask victims to type a password or approve an MFA push, actions many users have been trained to scrutinize. Instead, it asked for something that looks like routine technical data, a JSON payload, framed as a step in a legitimate-sounding group-joining process. This framing lowered suspicion and exploited the trust users place in copy-paste workflows between a real service and a connected application. Other 2026 incidents in the same investigation show related entry points, including exposed IAM credentials, service-account keys, GitHub personal access tokens, and stolen session tokens, some of which were harvested from public code repositories and tested with minimal requests to avoid detection.

What to Watch For

• Any portal or form that asks you to paste raw JSON, access tokens, or session data from another legitimate service.
• Unexpected invitations to join a group, connect an application, or link an account to an LLM service.
• Sudden, unexplained enablement of LLM services, new API keys, or unusual usage and billing activity.
• API keys or credentials appearing in public code repositories.

Financial services, retail, technology, and transportation organizations were affected across the Americas and Asia Pacific, with developers, cloud administrators, LLM application owners, and finance teams all exposed to risk from this kind of technique.

Building Resistance

Organizations can reduce exposure by training developers, cloud administrators, and LLM application owners to never paste tokens or session data from a legitimate service into a separate portal or chat window. Unexpected requests to join an LLM group or connect an application should be treated as potential credential theft and verified through a known internal contact or official service channel. Teams should also avoid storing API keys and cloud credentials in public repositories and rotate any exposed key immediately. Finally, security operations and finance teams should escalate unexpected LLM service activation, new API keys, or billing spikes as critical security events, since stolen access can generate large unauthorized charges in a very short time.

How did the fake LLM portal bypass MFA?

Users were tricked into pasting a raw JSON payload containing an active access token into a fake portal, which then posted the token to a backend API, bypassing password and MFA controls entirely.

What is LLMJacking?

LLMJacking refers to incidents where attackers steal or abuse cloud and LLM access, often through stolen credentials or tokens, to run up unauthorized charges or resell access through services described as LLM Mixers.

Who was targeted in these incidents?

Mandiant responded to 2026 incidents affecting financial services, retail, technology, and transportation organizations across the Americas and Asia Pacific, with developers, cloud administrators, and IAM administrators among the target roles.

What should organizations do to prevent this kind of attack?

Never paste access tokens or raw JSON from a legitimate service into a separate portal, avoid storing API keys in public repositories, and treat unexpected LLM service activation or usage spikes as critical security events.