From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Summary

Wiz's Customer Incident Response Team reports a rising pattern in which threat actors hijack cloud billing accounts to fund unauthorized LLM API usage, in some cases incurring hundreds of thousands of dollars in charges. The campaigns described target Google Cloud Platform: attackers compromised privileged user credentials through a phishing page reached via a Google Search ad, then linked attacker-controlled GCP projects to the victim's billing accounts. Because the AI workloads ran in foreign projects, the victim could not see prompt contents or model outputs.

Related items

• InfoGoogle’s more personalized Gemini AI is heading to your carSame vendor · The Verge (AI)
• InfoGemini 4 Argon on Cursor: solid security score, two unique solves, but slower and more expensive | Endor LabsSame vendor · Endor Labs Blog
• InfoUS bans DeepSeek AI from government use as tech tension with China continuesSame vendor · BBC Technology
• MediumFake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficSame vendor · The Hacker News
• MediumOpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API KeysSame vendor · The Hacker News