A single click on a sponsored Google Search ad for "google cloud" was enough to land some organizations with tens to hundreds of thousands of dollars in somebody else's AI bills. Wiz's Customer Incident Response Team (CIRT) says it has investigated multiple intrusions in which attackers phished Google Cloud Platform (GCP) administrators, took over their billing accounts, and charged mass Gemini API usage to the victims, a pattern known as LLMjacking.
The twist in Wiz's report is that the victims paid for the AI usage but could never see it. The attackers ran their workloads in their own GCP projects and linked those projects to the victim's billing account, so prompts and model outputs never touched the victim's logs.
A fake Google login behind a real Google ad
The attackers bought Google Search ads for administrative search terms such as "google cloud" and "gcp". Clicking one led through a Google Sites redirect to a fake Google login page that captured the user's password and multi-factor authentication (MFA) code, then bounced them to the real Google sign-in prompt. Asked to log in a second time, victims likely assumed it was a glitch. Meanwhile the phishing kit logged in automatically from 212[.]73[.]134[.]136, and the operator returned minutes later from a second address. Google flagged that first login as suspicious and emailed the user, and Wiz says Google Ads has since removed the malicious ad campaign.
Rewiring billing so the victim pays and sees nothing
Inside, the attackers worked through existing, low-usage projects rather than building new infrastructure. They enabled the Gemini API, created service accounts with Gemini API keys, and gave them high-privilege roles such as roles/ml.admin. They then deleted organization policies such as iam.allowedPolicyMemberDomains, the guardrail that restricts IAM membership to the company's own domains, which let them add attacker-controlled Gmail accounts to the billing account and grant roles such as roles/billing.admin.
With that role, they linked external GCP projects to the victim's billing account. Two evasion steps followed: later activity came from IP addresses geolocated in each victim's headquarters country, and existing billing administrators were demoted to read-only viewers, stripping their ability to detach the rogue projects from the console. Within 24 to 48 hours of initial access, victims saw unauthorized Gemini API charges reaching tens to hundreds of thousands of dollars.
Wiz CIRT also described a separate case this week in which an AI agent ran a whole cloud break-in. In the LLMjacking intrusions the AI is not the weapon but the prize: the break-in exists to get free inference.
Hunt for outside accounts and deleted domain policies
Wiz recommends that GCP customers:
- Review GCP IAM for users with external domains, especially consumer providers such as @gmail.com.
- Check audit logs for changes to organization policies, especially allowedPolicyMemberDomains, and for IAM changes involving billing account administrators.
- Look for unexpected Gemini API enablement, service account creation and API key creation in old projects.
- Ingest Google Workspace user log events and watch for suspicious login flags and unusual re-authentication.
- Monitor for abnormal surges in API costs and consider enforcing spend caps.
Indicators published by Wiz include the initial-login IP 212[.]73[.]134[.]136 and lookalike phishing domains such as gboogl[.]com, groosl[.]com, gprokl[.]com, gxoosl[.]com, gsool[.]space and gbrokl[.]xyz. The automated security email did not stop these intrusions, which is Wiz's point about not relying on user awareness alone. For many teams, the first sign that an account has become somebody else's AI budget may be the invoice.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.