From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

What it is

Wiz CIRT describes LLMjacking campaigns against Google Cloud customers in which attackers take over a privileged user, then attach their own GCP projects to the victim's billing account. Gemini API usage in those projects is charged to the victim. Victims saw tens to hundreds of thousands of dollars in charges within 24 to 48 hours of initial access. The page gives no date for the campaigns and no count of victims.

How it works

The user clicks a malicious Google Search ad (terms like "google cloud" and "gcp") and passes through a Google Sites redirect to a fake login page. The page captures the password and MFA code, then sends the user back to the real Google prompt. The user signs in a second time and likely assumes a glitch. Meanwhile the phishing kit logs in at once from 212.73.134[.]136, then re-authenticates minutes later from a second IP that is used for the rest of the activity.

Inside the environment the attacker:

• Picks existing, low-usage projects, enables the Gemini API, and creates service accounts with Gemini API keys. Those accounts get roles/ml.admin and roles/mcp.toolUser.
• Deletes the organization policy iam.allowedPolicyMemberDomains, which lifts the restriction on non-corporate IAM members.
• Adds attacker-controlled Gmail accounts to the billing account and grants roles/billing.admin.
• Links external attacker projects to the victim billing account, so all API calls there are billed to the victim and prompts and outputs never appear in the victim's logs.
• Demotes existing billing admins to billing viewers, so they cannot detach the rogue projects from the console.
• Moves later activity to IPs geolocated in the victim's headquarters country, even when the user is elsewhere.

What to do

• Ingest Google Workspace user log events and alert on suspicious-login flags and unexpected re-authentication. Google sent alert emails to the victim, and Wiz says not to rely on users noticing them.
• Review IAM for external-domain members, especially @gmail.com.
• Audit for changes to organization policy, especially allowedPolicyMemberDomains, and for IAM changes on billing account administrators.
• Audit for Gemini API enablement, service account creation and service account key creation in old projects.
• Monitor for cost surges in API usage and consider enforcing spend cap budgets.
• Search Workspace and GCP audit logs for the IOCs. The page lists 212.73.134[.]136, but the IOC section itself is empty in the fetched text.

Caveats

• The victim cannot see what the workloads did, because they ran in foreign tenants. The purpose of the usage is unknown.
• The Wiz queries and Threat Intel Center advisory are for Wiz customers. The page gives no query text.
• Google Ads removed the malicious campaign after it was reported, so the ad vector may no longer be live. The page does not say whether similar ads have reappeared.