Threat feed

GCP billing LLMjacking

GCP billing-account hijack for LLMjacking: search-ad phishing to cross-tenant Gemini inference at the victim's expense

Posted · Updated · Spectrum Delta Research Team

Summary

Wiz CIRT's incident-response report (Oct 20, A/3) documents multiple observed intrusions in which threat actors hijacked Google Cloud Platform billing accounts to fund unauthorized LLM usage. The chain: Google Search ads on admin terms ('google cloud', 'gcp') led through a Google Sites redirect to a fake Google login that captured credentials AND MFA codes; the kit immediately replayed them for the first malicious login, then the actor re-authenticated from a second IP minutes later. In existing low-usage GCP projects the actor enabled the Gemini API, created service accounts with API keys, and granted roles/ml.admin and roles/mcp.toolUser; deleted the iam.allowedPolicyMemberDomains organization policy; added external Gmail accounts with roles/billing.admin; linked attacker-controlled projects to the victim's billing account (cross-tenant: prompts and outputs stayed in the attacker's tenants, invisible to the victim); demoted legitimate billing admins to viewers; and blended geographically via IPs in the victim's HQ country. Within 24-48 hours victims saw tens to hundreds of thousands of dollars in Gemini API charges (Wiz CIRT, A/3).

Breakdown

Adversary

No actor name or attribution is provided by the primary — the report describes 'threat actors' generically across multiple investigated intrusions

Procedures (4)

  1. Search-ad phishing with MFA capture and immediate replay

    Spearphishing via search ad with credential and MFA capture

    Logs

    • Google Workspace User Log Events · Suspicious login flags; anomalous re-authentication triggers

    Detectors

    No known detector

Click to expand remaining (3) procedures

  1. Gemini API enablement with privileged service-account keys

    Additional cloud credentials in dormant projects

    • T1098.001Account Manipulation: Additional Cloud Credentials

    Logs

    • GCP Admin Activity audit logs · Gemini API enablement; SA/key creation; org-policy and IAM changes

    Detectors

    No known detector

  2. Billing takeover via org-policy removal and external grants

    Billing-account takeover: guardrail removal and external control

    • T1098Account Manipulation

    Logs

    • GCP Admin Activity audit logs · Gemini API enablement; SA/key creation; org-policy and IAM changes

    Detectors

    No known detector

  3. Unauthorized LLM inference at the victim's expense

    Resource hijacking: LLM inference billed to the victim

    Logs

    • Cloud Billing audit logs / cost export · Billing-account role changes; project linkage; cost surges above baseline

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Wiz CIRT (https://www.wiz.io/blog/from-phishing-to-llmjacking), A/3) — initial-login IP 212.73.134[.]136; phishing domains (17 per the primary's IOC table): gboogl[.]com, groosl[.]com, gprokl[.]com, gxoosl[.]com, gsoolg[.]com, gwoogl[.]com, gzoozl[.]com, groonl[.]com, gsool[.]space, gbrokl[.]space, gbrokl[.]xyz, gsoosl[.]xyz, gsool[.]xyz, gpoosl[.]com, groolg[.]com, gcslom[.]com, gcoalg[.]com (all wildcard-prefixed); the second IP used for subsequent activity is NOT provided by the primary; no project names or identifiers provided. Assessed 2026-10-24, hunt-only — the phishing kit domains are perishable attacker infrastructure and the kit IP may rotate; the durable hunt value is the behavioral chain in GCP audit logs, not these indicators.

Detailed

IP: 212.73.134[.]136 (initial kit login; the second IP for subsequent activity is not disclosed). Phishing domains (17, wildcard-prefixed per the primary's IOC table): gboogl[.]com, groosl[.]com, gprokl[.]com, gxoosl[.]com, gsoolg[.]com, gwoogl[.]com, gzoozl[.]com, groonl[.]com, gsool[.]space, gbrokl[.]space, gbrokl[.]xyz, gsoosl[.]xyz, gsool[.]xyz, gpoosl[.]com, groolg[.]com, gcslom[.]com, gcoalg[.]com. Roles observed: roles/ml.admin, roles/mcp.toolUser (service accounts), roles/recommender.billingAccountCudAdmin (projects), roles/billing.admin (billing accounts). Organization policy deleted: iam.allowedPolicyMemberDomains. Project names: not disclosed (existing low-usage victim projects; external actor-controlled projects). Charges: tens to hundreds of thousands of USD within 24-48h. All from the primary (Wiz CIRT (https://www.wiz.io/blog/from-phishing-to-llmjacking), A/3), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of GCP billing LLMjacking? Bring them to the community.

Discuss in the Tradecraft Slack