{"data":{"id":"43ade90f-b673-479d-8bb6-b75091ecff37","title":"From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage","summary":"Wiz's Customer Incident Response Team reports a rising pattern in which threat actors hijack cloud billing accounts to fund unauthorized LLM API usage, in some cases incurring hundreds of thousands of dollars in charges. The campaigns described target Google Cloud Platform: attackers compromised privileged user credentials through a phishing page reached via a Google Search ad, then linked attacker-controlled GCP projects to the victim's billing accounts. Because the AI workloads ran in foreign projects, the victim could not see prompt contents or model outputs.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.wiz.io/blog/from-phishing-to-llmjacking","publishedAt":"2026-10-20T20:03:10.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain","other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Gemini API","Google Cloud Platform (GCP)","Google Ads","Vertex AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-20T20:03:10.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}