Google’s threat researchers investigated real attacks in which criminals stole cloud and AI-service access, then ran up charges exceeding $100,000 in a day and, in one case, nearly $1 million. One group used a fake LLM user sign-up portal to trick visitors into providing active access tokens, while other attackers harvested exposed keys from public code repositories.
A group tracked as UNC6993 hosted a fake portal that posed as a sign-up page for a group of LLM users. Visitors were redirected to the real LLM service, then instructed to paste back a raw JSON payload containing an active access token. Because the token itself represented an already authenticated session, passwords and multifactor authentication no longer stood in the way once an attacker had it in hand. Separately, other attackers scraped LLM API keys from public GitHub repositories and tested each one with a request capped at a single output token, a method designed to avoid triggering volume-based alerts in victim organizations' security monitoring tools.
This technique worked because it blended a familiar sign-up flow with a request that felt procedural rather than suspicious. Sending users to the legitimate LLM service first, then asking them to copy and return a token, made the request look like part of normal account setup rather than a credential handoff. The single-token testing approach for scraped keys also succeeded because it was quiet by design, staying below thresholds that would normally flag unusual API activity.
Organizations and individual users can reduce exposure to this type of attack with a few concrete habits. Never paste API keys, access tokens, or raw authentication JSON into a sign-up page, support form, or third-party portal, and rely only on approved sign-in and token-management processes. Keep API keys and personal access tokens out of public code repositories, and revoke any key that may have been exposed as soon as possible. Treat any unexpected activation of a cloud AI service or sudden AI-service spending as a critical incident requiring immediate investigation. Finally, apply spending caps, scope API keys to specific models and environments, and monitor logs for the small, single-token pings attackers use to quietly validate stolen keys. Stolen cloud and AI-service access can generate costs quickly, with cases reaching more than $100,000 in a single day, so early detection and strict handling of tokens and keys matter as much as traditional password hygiene.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The portal posed as a sign-up page for a group of LLM users, sent visitors to the real LLM service, then told them to paste back a raw JSON payload containing an active access token.
Once attackers had the active access token itself, passwords and multifactor authentication no longer stood in the way, since the token already represented an authenticated session.
One actor scraped LLM API keys from public GitHub repositories and tested each one with a request capped at a single output token to avoid triggering volume-based alerts.
Any unauthorized enablement of a cloud AI service, such as Amazon Bedrock or the Gemini API, should be treated as a critical security event and investigated immediately.
An LLM user-group sign-up asks for your access token? Stop. UNC6993’s fake portal sends you to the real LLM service, then says: ‘Paste back a raw JSON payload containing an active access token.’ That’s the trap. The real-service detour makes it feel legitimate. But handing over that token can bypass your password and MFA. Stolen access has driven bills past $100,000 in a day. One rule: never paste a token or authentication JSON into a sign-up portal.
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft says attackers are impersonating IT support and using “passkey/MFA/SSO update” requests to trick employees into authenticating attacker-controlled sessions. The campaigns use attacker-in-the-middle phishing sites or device-code logins to capture valid session tokens, then access Microsoft…
