{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/billing-fraud/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:google:google_cloud_platform:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Google Cloud Platform"],"_cs_severities":["high"],"_cs_tags":["cloud-security","phishing","billing-fraud","identity-compromise"],"_cs_type":"advisory","_cs_vendors":["Google"],"content_html":"\u003cp\u003eThe Wiz Customer Incident Response Team (CIRT) has identified a trend where threat actors compromise Google Cloud Platform (GCP) credentials to hijack billing accounts for unauthorized AI resource consumption. By leveraging phishing campaigns via sponsored search ads, attackers obtain valid user credentials and MFA codes. Once access is gained, they perform privilege escalation and modify organizational policies, such as 'iam.allowedPolicyMemberDomains', to remove guardrails that restrict IAM membership to verified domains. This allows the integration of external, attacker-controlled accounts. The attackers then link external GCP projects to the victim's billing account. By executing AI workloads within these foreign projects, the actors obfuscate their prompts and outputs from the victim's visibility while simultaneously billing the victim for all API usage. This 'LLMjacking' activity leads to rapid billing surges, often reaching hundreds of thousands of dollars within 48 hours of initial compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker purchases sponsored search ads for terms like \u0026quot;google cloud\u0026quot; to host phishing kits on Google Sites.\u003c/li\u003e\n\u003cli\u003eVictim clicks the malicious ad, provides credentials and MFA tokens on a deceptive login page, which captures the data and redirects to a legitimate Google prompt.\u003c/li\u003e\n\u003cli\u003eAttacker uses harvested credentials to initiate login, bypassing MFA through the captured session data.\u003c/li\u003e\n\u003cli\u003eAttacker enables the Gemini API in existing, low-usage projects and creates service accounts with high-privileged roles (e.g., 'roles/ml.admin').\u003c/li\u003e\n\u003cli\u003eAttacker dismantles organizational policies by deleting 'iam.allowedPolicyMemberDomains' to allow external account access.\u003c/li\u003e\n\u003cli\u003eAttacker invites external attacker-controlled accounts to the organization's billing account and assigns the 'roles/billing.admin' role.\u003c/li\u003e\n\u003cli\u003eAttacker links their external GCP projects to the victim's billing account to offload AI API costs.\u003c/li\u003e\n\u003cli\u003eAttacker demotes original billing administrators to 'viewer' roles to prevent detection and reclamation of administrative control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eVictim organizations in the cloud sector have faced significant financial damage, with unauthorized Gemini API charges reaching tens to hundreds of thousands of dollars within 48 hours. Because workloads are executed in foreign projects, organizations lack visibility into the nature of the data being processed, creating both financial and data security risks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor Google Workspace and GCP audit logs for logins originating from the documented IP infrastructure (212.73.134.136).\u003c/li\u003e\n\u003cli\u003eRegularly audit GCP IAM configurations for unexpected additions of external domains or personal email addresses (e.g., @gmail.com) to high-privileged roles.\u003c/li\u003e\n\u003cli\u003eAudit GCP organization policies for modifications to 'iam.allowedPolicyMemberDomains', as this is a primary indicator of disabling organizational guardrails.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected enabling of the Gemini API product in projects, especially those with minimal historical activity.\u003c/li\u003e\n\u003cli\u003eProactively audit billing account permissions to ensure only authorized corporate identities hold 'roles/billing.admin' or other administrative roles.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:53:02Z","date_published":"2026-10-20T23:53:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-llmjacking-gcp/","summary":"Threat actors are hijacking Google Cloud Platform billing accounts via phishing and policy manipulation to conduct large-scale, unauthorized LLM inference, resulting in significant financial losses for victims.","title":"Google Cloud Platform: Billing account hijacking for unauthorized AI usage","url":"https://feed.craftedsignal.io/briefs/2026-10-llmjacking-gcp/"}],"language":"en","title":"CraftedSignal Threat Feed - Billing-Fraud","version":"https://jsonfeed.org/version/1.1"}