Google Ties April Cloud Intrusion to Unauthorized 48-vCPU Instances

Google Threat Intelligence Group identified an April 2026 cloud intrusion that began with an exposed GitHub personal access token and expanded into unauthorized AI workloads and high-performance computing. The attacker enabled Gemini Enterprise and provisioned compute. The intrusion also placed LiteLLM and Manus agent-framework containers on Cloud Run services that were publicly accessible. The activity also involved creating an Editor-level service account. The attacker requested quota increases for NVIDIA RTX 6000 hardware before launching additional 48-vCPU instances. LLMjacking describes the hijacking of enterprise cloud infrastructure to run unauthorized AI workloads. Simon Yoon reports on blockchain technology for TokenPost.

Source: TokenPost