# From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage

> Threat actors phish GCP administrator credentials and MFA codes via sponsored Google Search ads and fake Google login pages, then use the admin access to link attacker-controlled GCP projects to the victim's billing account. This enables unauthorized Gemini API usage that is hidden from the victim's logs, with charges reported in the tens to hundreds of thousands of dollars within 24-48 hours.

- **Published:** 2026-10-20T21:11:19Z
- **Last reviewed:** 2026-10-20T21:11:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3987
- **ID:** TL-2026-3987
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Wiz investigated multiple intrusions in which threat actors purchased Google Search ads for administrative terms such as "google cloud" and "gcp". The ads redirected victims through Google Sites pages to fake Google login pages hosted on lookalike domains (for example gboogl.com, groosl.com, gsool.xyz). The phishing page captured the victim's credentials and MFA code, then seamlessly redirected the user back to the legitimate Google authentication prompt. An automated phishing kit immediately replayed the harvested credentials; the first malicious GCP login came from 212.73.134.136, and a second authentication from a different IP carried the follow-on activity. Activity was geolocated to the victim organization's headquarters country, which helps it blend in with normal logins.

Once inside, the actors enabled the Gemini API product and created service accounts with Gemini API keys, granting them high-privilege roles such as roles/ml.admin and roles/mcp.toolUser. To allow external identities, they deleted the iam.allowedPolicyMemberDomains organization policy, which restricts IAM membership to verified company domains. They then added external attacker-controlled Gmail accounts to the victim organization and assigned roles including roles/recommender.billingAccountCudAdmin and roles/billing.admin.

The core novelty is cross-tenant billing linkage: using roles/billing.admin, the actors linked attacker-controlled external GCP projects to the victim's internal billing account. Gemini API requests made from those projects are charged to the victim while the prompts and outputs stay invisible to the victim's own logs. To block remediation, the actors demoted legitimate billing administrators to read-only roles. Within 24 to 48 hours of initial access, victims saw unexpected charges reaching tens to hundreds of thousands of dollars. Wiz characterizes the campaign as non-destructive financial exploitation that offloads the cost of high-volume LLM inference onto victims. No threat actor attribution is provided in the source.

This is a variant of LLMjacking, first publicly described by Sysdig in May 2024, in which stolen cloud credentials are used to consume cloud-hosted LLM services at the victim's expense. This campaign differs by abusing the billing-account trust relationship rather than abusing the victim's own project resources.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1589.001 Credentials
- T1566.002 Spearphishing Link
- T1111 Multi-Factor Authentication Interception
- T1078.004 Cloud Accounts
- T1136.003 Cloud Account
- T1098.001 Additional Cloud Credentials
- T1098.003 Additional Cloud Roles
- T1685 Disable or Modify Tools
- T1531 Account Access Removal
- T1496.004 Cloud Service Hijacking

## Sources

- [From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage (Wiz)](https://www.wiz.io/blog/from-phishing-to-llmjacking)
- [LLMjacking: Stolen Cloud Credentials Used in New AI Attack (Sysdig)](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/)
- [Researchers Uncover 'LLMjacking' Scheme Targeting Cloud-Hosted AI Models (The Hacker News)](https://thehackernews.com/2024/05/researchers-uncover-llmjacking-scheme.html)
- [New 'LLMjacking' Attack Exploits Stolen Cloud Credentials (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/llmjacking-exploits-stolen-cloud)
- [LLMjacking: Stolen API Key, Hidden Cost (Auth0)](https://auth0.com/blog/llmjacking-stolen-api-key-hidden-cost/)
- [LLM jacking cloud AI cybercrime (Techweez)](https://techweez.com/2026/09/28/llm-jacking-cloud-ai-cybercrime/)
- [What is LLM Jacking? (Wiz Academy)](https://www.wiz.io/academy/ai-security/llm-jacking)
- [Related user report: Gemini API account compromised, $8,341 fraudulent charges (Google AI Developers Forum)](https://discuss.ai.google.dev/t/gemini-api-account-compromised-8-341-fraudulent-charges-and-no-support-response/146933)
- [Related user report: Unexpected EUR 5k Gemini API spike in under 1 hour (Google AI Developers Forum)](https://discuss.ai.google.dev/t/unexpected-5k-gemini-api-spike-in-under-1-hour-suspected-hijacking-apis-still-blocked-credit-balance-still-owed/144408)
- [Related user report: production project hijacked April 23, ~200,000 SEK fraud (Google AI Developers Forum)](https://discuss.ai.google.dev/t/production-project-hijacked-april-23-200-000-sek-fraud-5-open-support-cases-multiple-written-commitments-broken-needs-trust-safety-attention/144762)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3987