- Wiz's incident response team found attackers linking their own Google Cloud projects to victims' billing accounts, so victims were billed for Gemini API usage they could not see.
- Wiz says victims faced charges in the tens to hundreds of thousands of dollars within one to two days of the first login.
- Review who can administer billing, whether outside accounts hold roles, and who is alerted when AI spending jumps.
Most breach stories ask what was taken. This one asks what was spent. Wiz's Customer Incident Response Team (CIRT) describes attackers who did not want a company's data. They wanted its credit line.
What Wiz found
Wiz CIRT says it has investigated multiple intrusions of a rising pattern: attackers hijack cloud billing accounts to pay for large-scale use of large language models (LLMs). Wiz calls this LLMjacking. Its post focuses on campaigns against Google Cloud Platform (GCP).
Wiz says the bills arrived fast. Within one to two days of the first login, victims faced Gemini API charges in the tens to hundreds of thousands of dollars. That was far above each organization's usual compute spend.
Wiz does not name victims or say how many organizations were hit. It also does not know what the AI workloads did. That second gap is the heart of the story.
How the attack worked
It began with a paid search ad. Wiz says the attacker bought Google Search ads for terms such as "google cloud" and "gcp". Anyone who clicked was passed through a page on Google Sites and landed on a counterfeit Google sign-in screen.
Victims entered their password and their multi-factor authentication (MFA) code. The page captured both, then sent the user back to the real Google sign-in. The user had to log in twice and likely assumed a glitch. Meanwhile, Wiz says, an automated kit used the stolen details at once to log in from 212.73.134[.]136. Google Ads has since removed the campaign after reports.
Inside the account, the attacker used its excessive privileges. Wiz says it picked existing, low-usage projects rather than building new ones. There it created service accounts (non-human identities) with Gemini API keys. It gave them high-privilege roles, including roles/ml.admin and roles/mcp.toolUser.
Next it deleted an organization policy, iam.allowedPolicyMemberDomains. That policy limits access to verified company domains. With it gone, the attacker added its own Gmail accounts to the billing account and gave them roles such as roles/billing.admin. Wiz says that role allows full control, including attaching external projects and changing payment settings.
Then came the key step. The attacker linked its own GCP projects to the victim's billing account. Every API call made in those projects was charged to the victim.
The payer cannot see the work
Here is the idea worth holding onto. Cloud billing joins two things most firms assume travel together: who pays and who can see. In this attack they were split apart.
Wiz says the key creation, prompts and model outputs all sat inside foreign tenants. The victim carried the financial responsibility. Its own security and audit logs showed nothing about what the AI was doing.
Older telephone fraud had the same shape. Attackers who took over a company phone system made calls the company paid for. The difference here is scale and speed. An AI API can turn stolen billing rights into a large invoice in a day or two.
How the attacker bought time
Wiz describes two moves meant to delay a response. First, after the initial login, activity came from IP addresses in each victim's headquarters country, even when the compromised user was elsewhere. That helps avoid location-based alerts.
Second, the attacker demoted existing billing administrators to read-only viewers. In Wiz's account, those administrators could no longer pull back permissions or unlink the attacker's projects from the console. The people who would normally act on a billing surge had lost those abilities.
Google did flag the first login and emailed the user. Wiz's advice is blunt: do not rely on user awareness alone. It recommends ingesting Google Workspace user log events and watching for suspicious login flags.
Questions to put to your team
Wiz's hunting guidance turns into questions a finance or security leader can ask this week.
Who holds billing administrator rights, and can anyone outside our corporate domain hold any role? Wiz suggests checking GCP IAM for external addresses, especially personal providers such as @gmail.com.
Who is alerted when org policy controls such as allowedPolicyMemberDomains change? Do billing-admin changes reach a person or only a log?
Do we get alerts when Gemini API access, service accounts or service account keys appear in old, quiet projects?
Do we have spend caps and anomaly alerts on AI usage, and does someone own the response at night? Wiz suggests monitoring for abnormal cost surges and potentially enforcing spend caps.
Do we have a way to recover billing control if our administrators are demoted?
The takeaway
Security teams have long guarded data. Wiz's findings show that in these cases the target was the right to spend. When AI is billed by use, a stolen billing account is a stolen budget. Treat who can pay as seriously as who can read.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wiz.
