/
← Voltar ao feed
high

Threat actors phish GCP admins via malicious Google Search ads and hijack billing accounts to fund mass Gemini API LLMjacking

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 17:03 · coletado há 3 horas

The Wiz Customer Incident Response Team (CIRT) reports a rising pattern of LLMjacking in which threat actors compromise privileged Google Cloud Platform (GCP) users solely to offload the cost of large-scale LLM inference onto the victim. Attackers link external, attacker-controlled GCP projects to the victim's billing account, so all Gemini API usage is charged to the victim while prompts and outputs stay invisible to the victim's logs. Victims saw unauthorized charges of tens to hundreds of thousands of dollars within 24 to 48 hours of initial access. Initial access came from phishing through purchased Google Search ads. The activity is non-destructive and financially motivated. Google Ads has removed the malicious campaign after reports.

Technical Details

  • Initial access: Attackers bought Google Search ads for terms such as "google cloud" and "gcp". Clicking the ad led through a Google Sites redirect to a fake Google login page that captured credentials and MFA codes, then sent the user back to the legitimate login prompt. The phishing kit immediately used the stolen credentials for the first login from 212.73.134.136. The actor reauthenticated minutes later from a second IP, which was used for the rest of the activity.
  • Persistence and privilege escalation: Attackers targeted existing low-usage projects, enabled the Gemini API, created service accounts with Gemini API keys, and added them to high-privilege roles such as roles/ml.admin and roles/mcp.toolUser.
  • Guardrail removal: They deleted the organization policy iam.allowedPolicyMemberDomains, which allowed external accounts to be granted access.
  • Billing takeover: External actor-controlled Gmail accounts were added to the billing account and given roles such as roles/billing.admin and roles/recommender.billingAccountCudAdmin. External GCP projects were then linked to the victim's billing account, creating cross-tenant billing.
  • Defense evasion: After the first login, activity came from IP addresses geolocated in the victim organization's headquarters country. Existing billing administrators were demoted to read-only billing viewers so they could not revoke permissions or detach the rogue projects.
  • Detection: Ingest Google Workspace user log events for suspicious-login flags and anomalous re-authentication. Review IAM for external-domain members, especially @gmail.com. Review audit logs for changes to allowedPolicyMemberDomains, billing-admin IAM changes, and unexpected Gemini API enablement, service account creation and API key creation in old projects. Monitor for abnormal API cost surges.

Remediation

  • Do not rely on user awareness of Google security alert emails alone. Alert on suspicious logins and re-authentications in Google Workspace logs.
  • Enforce iam.allowedPolicyMemberDomains and alert on any change to it.
  • Audit IAM and billing-account membership for non-corporate identities and unexpected billing administrators.
  • Enforce spend-cap budgets and cost anomaly monitoring for AI API usage.
  • Restrict privileged roles and review dormant projects for unexpected API enablement and service account keys.

Linha do tempo

  1. wiz.io ↗ · pub. 20/10/2026 17:03 · coletado 20/10 18:00 primeiro registro

    Threat actors phish GCP admins via malicious Google Search ads and hijack billing accounts to fund mass Gemini API LLMjacking

    ler a análise desta fonte

    The Wiz Customer Incident Response Team (CIRT) reports a rising pattern of LLMjacking in which threat actors compromise privileged Google Cloud Platform (GCP) users solely to offload the cost of large-scale LLM inference onto the victim. Attackers link external, attacker-controlled GCP projects to the victim's billing account, so all Gemini API usage is charged to the victim while prompts and outputs stay invisible to the victim's logs. Victims saw unauthorized charges of tens to hundreds of thousands of dollars within 24 to 48 hours of initial access. Initial access came from phishing through purchased Google Search ads. The activity is non-destructive and financially motivated. Google Ads has removed the malicious campaign after reports.

    Technical Details

    • Initial access: Attackers bought Google Search ads for terms such as "google cloud" and "gcp". Clicking the ad led through a Google Sites redirect to a fake Google login page that captured credentials and MFA codes, then sent the user back to the legitimate login prompt. The phishing kit immediately used the stolen credentials for the first login from 212.73.134.136. The actor reauthenticated minutes later from a second IP, which was used for the rest of the activity.
    • Persistence and privilege escalation: Attackers targeted existing low-usage projects, enabled the Gemini API, created service accounts with Gemini API keys, and added them to high-privilege roles such as roles/ml.admin and roles/mcp.toolUser.
    • Guardrail removal: They deleted the organization policy iam.allowedPolicyMemberDomains, which allowed external accounts to be granted access.
    • Billing takeover: External actor-controlled Gmail accounts were added to the billing account and given roles such as roles/billing.admin and roles/recommender.billingAccountCudAdmin. External GCP projects were then linked to the victim's billing account, creating cross-tenant billing.
    • Defense evasion: After the first login, activity came from IP addresses geolocated in the victim organization's headquarters country. Existing billing administrators were demoted to read-only billing viewers so they could not revoke permissions or detach the rogue projects.
    • Detection: Ingest Google Workspace user log events for suspicious-login flags and anomalous re-authentication. Review IAM for external-domain members, especially @gmail.com. Review audit logs for changes to allowedPolicyMemberDomains, billing-admin IAM changes, and unexpected Gemini API enablement, service account creation and API key creation in old projects. Monitor for abnormal API cost surges.

    Remediation

    • Do not rely on user awareness of Google security alert emails alone. Alert on suspicious logins and re-authentications in Google Workspace logs.
    • Enforce iam.allowedPolicyMemberDomains and alert on any change to it.
    • Audit IAM and billing-account membership for non-corporate identities and unexpected billing administrators.
    • Enforce spend-cap budgets and cost anomaly monitoring for AI API usage.
    • Restrict privileged roles and review dormant projects for unexpected API enablement and service account keys.