Image: datocms-assets.com · rights & removal

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Reporting by Wiz BlogRead the original at wiz.io

Executive Summary

Threat actors are leveraging cloud billing accounts to fund massive, unauthorized execution of Large Language Models (LLMs), a pattern identified by the Wiz Customer Incident Response Team in Google Cloud Platform environments. The intrusion lifecycle begins with phishing campaigns using malicious ads on search engines that trick users into submitting credentials via fake login pages. Once privileged access is gained, attackers execute a multi-stage attack: they disable organizational guardrails like domain restrictions, grant external accounts administrative roles (such as billing admin), and link attacker-controlled external GCP projects to the victim's internal billing account. This structure allows the LLM API usage—and subsequent high costs, potentially reaching hundreds of thousands of dollars within 48 hours—to occur entirely outside the victim’s monitored tenants, rendering prompt content invisible to internal logs. Defense evasion is further executed by geo-blending activity and demoting legitimate administrators to read-only status before mass exploitation commences.

Facts Only

Phishing attacks commenced via Google Search ads advertising search terms like "google cloud."
Victims entered credentials, including MFA codes, into a malicious Google Sites redirect page impersonating Google Login.
Initial access was established using the harvested credentials from source IP 212.73.134[.]136.
Attackers enabled the Gemini API and minted service account keys within low-usage GCP projects.
The threat actors deleted organizational safety policies, specifically iam.allowedPolicyMemberDomains, removing domain restrictions on IAM membership.
External, attacker-controlled Gmail accounts were added to the organization’s billing account with roles like roles/billing.admin.
External GCP projects were linked directly to the victim's internal billing account for charge allocation.
Subsequent activity shifted from the initial IP to IPs geolocated within each victim organization's headquartered country.
Threat actors demoted pre-existing internal billing administrators from administrative to read-only roles.
Unauthorized LLM usage resulted in rapid, unexpected API charges reaching tens to hundreds of thousands of dollars within 24–48 hours.

Full Take

The core mechanism detailed here describes an economic attack disguised as a technical exploitation: LLMjacking through financial outsourcing. The narrative presents a highly sophisticated threat model where the digital infiltration serves not as the final goal, but as an infrastructure prerequisite for large-scale unauthorized consumption. What is most significant is the abstraction layer—the deliberate linkage of foreign tenants to internal billing accounts. This creates a functional firewall between the *activity* (prompts/outputs in the attacker's project) and the *cost center* (the victim’s account), fundamentally eroding audit visibility. The assumption underpinning this entire attack is that organizational controls are primarily designed for security isolation, not financial attribution across tenant boundaries.
The persistence phase—removing policy guardrails and crippling local admin authority—demonstrates a strategic pivot from pure system compromise to systemic governance hijacking. This suggests the threat actors are not merely after data exfiltration or destructive payload delivery, but rather resource arbitrage facilitated by poor cross-tenant visibility controls. The narrative relies heavily on presenting specific tooling (API enablement, policy deletion) as undeniable evidence of hostile intent; however, it simultaneously paints a picture where proactive monitoring *should* catch these actions before the financial consequence manifests.
Patterns detected: ARC-0045 False Framing (Framing resource abuse purely as an external "attack" rather than a systemic vulnerability in multi-cloud cost governance). ARC-0016 Authority Game (Heavy reliance on named vendor security advisories to frame the severity and necessity of purchasing their specific detection tools).
The underlying paradigm is one where opaque financial flows become vectors for adversarial action, turning cloud utility into a weaponized commodity. Human agency here is diminished by complexity; defenders are pushed toward tracking esoteric logs (Workspace events, specific IAM role changes) rather than monitoring business intent or expected resource utilization profiles. If the primary cost driver is simply "API usage," then organizations have successfully outsourced financial accountability to black-box foreign infrastructure.
If this informational campaign were part of a coordinated influence effort, the playbook would involve leveraging highly technical, niche incident reports (like this one) and tying them directly to vendor solutions that claim superior visibility into those specific log vectors. The current content does align with that pattern by heavily emphasizing the limitations of traditional internal logging while positioning product monitoring as the necessary countermeasure.
How can governance frameworks be adapted to enforce consumption-based access controls across independently provisioned, linked projects? What organizational policies are required to mandate transparency of external resource dependencies in cloud deployments? If costs are becoming weaponized through platform mechanics, how must procurement and budgetary models change to account for latent, un-auditable execution environments?

From the original · Wiz Blog

The Wiz Customer Incident Response Team (CIRT) has investigated a rising threat pattern in cloud environments: threat actors hijacking cloud billing accounts to fund unauthorized AI usage.

Read the full story at wiz.io

Sentinel — Human

Confidence

This document reads as a highly technical, vendor-specific threat intelligence briefing detailing the steps of an LLMjacking attack. Its precision and inclusion of proprietary response indicators suggest human cybersecurity analysis rather than generalized AI generation.

Signals Detected

The language is highly specific and technical (e.g., 'iam.allowedPolicyMemberDomains', 'cross-tenant access'), which signals deep subject matter expertise, not generic AI synthesis.

The structure is highly process-oriented (Initial Access -> Persistence -> Impact), which aligns with technical incident reporting rather than purely balanced argumentation.

The detailed inclusion of specific Cloud Events queries and numbered Indicators of Compromise provides practical, proprietary content typical of vendor threat reports.

Human Indicators

Use of highly specialized, internal nomenclature (e.g., Wiz CIRT, Gemini API keys)

Presentation as a direct tactical advisory (actionable guidance, specific IOCs)

The narrative progression mimics a forensic timeline rather than a general informational overview.