Threat reportCloud SecurityTL-2026-3987
From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage
From Phishing to LLMjacking (TL-2026-3987), also tracked as LLMjacking, is a high-severity cloud security threat, first published 2026-10-20. It has no confirmed attribution, affects Google Google Cloud Platform (billing accounts, IAM, Gemini API), maps to 12 MITRE ATT&CK techniques (T1078.004, T1098.001, T1098.003), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3987
- Threat ID
- TL-2026-3987
- Also known as
- LLMjacking, Gemini API billing hijack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- CLOUD
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud-services, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
How From Phishing to LLMjacking works
Threat actors phish GCP administrator credentials and MFA codes via sponsored Google Search ads and fake Google login pages, then use the admin access to link attacker-controlled GCP projects to the victim's billing account. This enables unauthorized Gemini API usage that is hidden from the victim's logs, with charges reported in the tens to hundreds of thousands of dollars within 24-48 hours.
Wiz investigated multiple intrusions in which threat actors purchased Google Search ads for administrative terms such as "google cloud" and "gcp". The ads redirected victims through Google Sites pages to fake Google login pages hosted on lookalike domains (for example gboogl.com, groosl.com, gsool.xyz). The phishing page captured the victim's credentials and MFA code, then seamlessly redirected the user back to the legitimate Google authentication prompt. An automated phishing kit immediately replayed the harvested credentials; the first malicious GCP login came from 212.73.134.136, and a second authentication from a different IP carried the follow-on activity. Activity was geolocated to the victim organization's headquarters country, which helps it blend in with normal logins.
Once inside, the actors enabled the Gemini API product and created service accounts with Gemini API keys, granting them high-privilege roles such as roles/ml.admin and roles/mcp.toolUser. To allow external identities, they deleted the iam.allowedPolicyMemberDomains organization policy, which restricts IAM membership to verified company domains. They then added external attacker-controlled Gmail accounts to the victim organization and assigned roles including roles/recommender.billingAccountCudAdmin and roles/billing.admin.
The core novelty is cross-tenant billing linkage: using roles/billing.admin, the actors linked attacker-controlled external GCP projects to the victim's internal billing account. Gemini API requests made from those projects are charged to the victim while the prompts and outputs stay invisible to the victim's own logs. To block remediation, the actors demoted legitimate billing administrators to read-only roles. Within 24 to 48 hours of initial access, victims saw unexpected charges reaching tens to hundreds of thousands of dollars. Wiz characterizes the campaign as non-destructive financial exploitation that offloads the cost of high-volume LLM inference onto victims. No threat actor attribution is provided in the source.
This is a variant of LLMjacking, first publicly described by Sysdig in May 2024, in which stolen cloud credentials are used to consume cloud-hosted LLM services at the victim's expense. This campaign differs by abusing the billing-account trust relationship rather than abusing the victim's own project resources.
MITRE ATT&CK techniques used in TL-2026-3987
Initial Access
T1078.004 Cloud Accounts; T1566.002 Spearphishing Link
Persistence
T1098.001 Additional Cloud Credentials; T1136.003 Cloud Account
Privilege Escalation
T1098.003 Additional Cloud Roles
Credential Access
T1111 Multi-Factor Authentication Interception
Impact
T1496.004 Cloud Service Hijacking; T1531 Account Access Removal
Resource Development
T1583.001 Domains; T1583.008 Malvertising
Reconnaissance
defense-impairment
Affected products and versions in From Phishing to LLMjacking
- Google — Google Cloud Platform (billing accounts, IAM, Gemini API)
Vulnerable versions: Organizations with admin credentials phished; no product vulnerability
Remediation for From Phishing to LLMjacking
Immediate actions
- Block 212.73.134.136 and the 16 listed phishing domains at DNS, proxy and email gateways
- Review GCP IAM for members with external domains, especially non-corporate providers such as @gmail.com, and remove unauthorized ones
- Review billing administrator role assignments and restore any legitimate billing admins demoted to read-only
- Verify the iam.allowedPolicyMemberDomains organization policy is intact and re-apply it if it was deleted
- Audit for newly created service accounts, API keys and Gemini API enablement, particularly in legacy projects
- Check which projects are linked to your billing accounts and unlink unknown external projects
Workarounds
- Restrict who holds roles/billing.admin and use separation of duties for billing and project administration
- Disable the Gemini API in projects that do not need it
Longer-term hardening
- Implement spend cap budgets and billing anomaly alerts
- Monitor for logins from multiple countries and impossible travel on cloud admin identities
- Adopt phishing-resistant MFA (FIDO2/passkeys) for GCP and Workspace administrators, since OTP codes can be relayed by the phishing page
- Train administrators to navigate to cloud consoles via bookmarks rather than search ads
- Alert on organization policy changes and role grants of billing.admin to external identities
Weaknesses (CWE) in From Phishing to LLMjacking
Timeline of From Phishing to LLMjacking
- Sysdig's original LLMjacking case began with exploitation of a vulnerable Laravel (CVE-2021-3129) to obtain cloud credentials, followed by InvokeModel probing and GetModelInvocationLoggingConfiguration checks to avoid detection; this campaign instead abuses phished GCP admin credentials and billing linkage
- Sysdig publicly describes 'LLMjacking': stolen cloud credentials used to consume cloud-hosted LLMs, with victim-borne costs estimated above $46,000 per day (reported by The Hacker News 2024-05-10)
- Related, unattributed user report on the Google AI Developers Forum of a Gemini API project hijack with fraud exceeding 200,000 SEK across billing accounts; not confirmed as part of this campaign
- Related forum poster files initial fraud report with Google support (case opened 2026-04-28) over the 2026-04-23 Gemini API key compromise; not confirmed as part of this campaign
- Google AI Developers Forum poster publishes account of Gemini API key compromise (from 2026-04-23) with 200,000+ SEK fraud across 4 billing accounts and credits issued but no refunds; poster attributes it to a systemic Gemini API key flaw, a claim not corroborated by Wiz and unconfirmed as related to this campaign
- Per the same forum poster, Google implements platform-wide Gemini API key restrictions; poster-reported, not independently verified
- Press coverage describes LLM jacking as a growing cybercrime trend in which victims pay for attacker AI usage
- Wiz (Shira Ayal, Andre Maccarone) publishes analysis of multiple intrusions: phishing via sponsored Google Search ads, org policy deletion, cross-tenant billing linkage and Gemini API abuse, with IP and 16 lookalike-domain IOCs
Sources cited for From Phishing to LLMjacking
- From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage (Wiz)
- LLMjacking: Stolen Cloud Credentials Used in New AI Attack (Sysdig)
- Researchers Uncover 'LLMjacking' Scheme Targeting Cloud-Hosted AI Models (The Hacker News)
- New 'LLMjacking' Attack Exploits Stolen Cloud Credentials (Infosecurity Magazine)
- LLMjacking: Stolen API Key, Hidden Cost (Auth0)
- LLM jacking cloud AI cybercrime (Techweez)
- What is LLM Jacking? (Wiz Academy)
- Related user report: Gemini API account compromised, $8,341 fraudulent charges (Google AI Developers Forum)
- Related user report: Unexpected EUR 5k Gemini API spike in under 1 hour (Google AI Developers Forum)
- Related user report: production project hijacked April 23, ~200,000 SEK fraud (Google AI Developers Forum)
Detection coverage for TL-2026-3987
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3987 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.