Case gtig-unc5673-llm-account-poolingLLMjackingWorldwide
PRC clusters UNC5673 and UNC6201 pooled Gemini, Claude and OpenAI accounts via proxies
GTIG found UNC5673 (overlapping TEMP.Hex) using Claude-Relay-Service and CLI-Proxy-API to share pooled accounts, and UNC6201 trialling a script that auto-registers premium LLM accounts with CAPTCHA and SMS bypass.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- May 11, 2026
- Location
- Worldwide
- Target
- Frontier model providers' account and billing controls
- Severity
- Medium
- Triggered by
- UNC5673 and UNC6201 (China)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
GTIG found UNC5673 (overlapping TEMP.Hex) using Claude-Relay-Service and CLI-Proxy-API to share pooled accounts, and UNC6201 trialling a script that auto-registers premium LLM accounts with CAPTCHA and SMS bypass.
Impact: State operators obtain model access without attribution or payment; provider losses not quantified.
Who triggered it
Actor: UNC5673 and UNC6201 (China)
Attribution: GTIG assesses both clusters as PRC-nexus; UNC5673 targets South and Southeast Asian governments.
Motive: Cheap, ban-resistant access to premium models for operations
How it happened
Attack vector: API aggregators, automated registration tools and fingerprint-isolating browsers
Root cause: Account provisioning and billing controls can be automated around
Timeline
- UNC6201 trials GitHub script that auto-registers and cancels premium LLM accounts
- GTIG publishes the obfuscated-access findings
Response
Google recommended providers build signal logic around aggregator infrastructure; accounts disabled.
Current status: Ongoing
Sources (open in a new tab)
- GTIG AI Threat Tracker May 2026 cloud.google.com
- Secure Blink coverage secureblink.com
Cite this case
PRC clusters UNC5673 and UNC6201 pooled Gemini, Claude and OpenAI accounts via proxies. AI Threat Watch, case gtig-unc5673-llm-account-pooling, May 11, 2026. https://aithreat.io/cases/gtig-unc5673-llm-account-pooling/
Permanent link: https://aithreat.io/cases/gtig-unc5673-llm-account-pooling/