From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

This campaign involves threat actors targeting GCP environments through phishing attacks delivered via sponsored search ads. After compromising privileged credentials through fake login pages, attackers manipulate organizational policies to disable security guardrails. They create service accounts with access to the Gemini API and invite external attacker-controlled accounts, assigning them administrative billing roles. By linking their external GCP projects to victim billing accounts, attackers execute large-scale AI workloads that generate unauthorized charges ranging from tens to hundreds of thousands of dollars within 1-2 days. The campaign employs evasion tactics including geographic IP blending and demoting legitimate administrators to hinder detection and response efforts.

Victims suffer unauthorized financial charges on their cloud billing accounts due to attacker-driven AI workload execution. Security controls are disabled, increasing exposure to further compromise. The attackers' ability to hide activity and demote legitimate administrators complicates detection and remediation, potentially leading to prolonged abuse and financial loss.

No official patch or fix applies as this is a campaign exploiting credential theft and misconfiguration. Organizations should strengthen phishing defenses, enforce multi-factor authentication for privileged accounts, monitor for unusual billing activity, and review IAM policies to prevent unauthorized service account creation and billing role assignments. Promptly investigate and remediate any signs of compromised credentials or policy changes. Employ anomaly detection for AI workload usage and billing spikes. Consider restricting external account invitations and billing account linkages where possible.