Phishing campaign uses stolen GCP access to bill victims for LLMs
Original title: From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
Attackers phished MFA codes, linked foreign projects to victim billing, and kept Gemini prompts hidden from the organization.
Wiz CIRT describes Google Cloud intrusions that start with sponsored-search ads leading to a fake Google login. Compromised console users are then used to enable the Gemini API, delete domain-restriction policy, add external accounts, and attach attacker projects to the victim billing account. Prompts and outputs stay outside the victim's logs. Google Ads removed the campaign after reports. Wiz says the goal was financial abuse of AI APIs.
Unconfirmed: Charge totals and campaign scope are Wiz CIRT's account of cases it investigated; victims are unnamed.
- Ads targeted searches for "google cloud" and "gcp," then used a Google Sites redirect.
- The phishing kit's first malicious login came from 212.73.134.136.
- Attackers deleted iam.allowedPolicyMemberDomains and added external Gmail accounts.
- roles/billing.admin allowed attaching external projects and changing payment settings.
- Later activity used IPs geolocated in each victim organization's headquarters country.
Impact: victim cloud bills charged for hidden attacker LLM use
- 1.Monitor Google Workspace User Log Events for suspicious logins and re-authentication.
- 2.Check billing accounts for external projects and unexpected billing.admin grants.
- 3.Review deletion of iam.allowedPolicyMemberDomains and new Gemini service accounts.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | domain.com | customers can use this Cloud Events query , and replace the domain.com with their own organization domain. Review GCP audit logs f |
| domain | gboogl.com | ure - IP seen in the initial login from the phishing page *.gboogl[.]com Domain Attacker infrastructure - phishing domain *.groosl |
| domain | gbrokl.space | l[.]space Domain Attacker infrastructure - phishing domain *gbrokl[.]space Domain Attacker infrastructure - phishing domain *gbrokl[ |
| domain | gbrokl.xyz | l[.]space Domain Attacker infrastructure - phishing domain *gbrokl[.]xyz Domain Attacker infrastructure - phishing domain *gsoosl[ |
| domain | gcoalg.com | lom[.]com Domain Attacker infrastructure - phishing domain *gcoalg[.]com Domain Attacker infrastructure - phishing domain |
| domain | gcslom.com | olg[.]com Domain Attacker infrastructure - phishing domain *gcslom[.]com Domain Attacker infrastructure - phishing domain *gcoalg[ |
| domain | gpoosl.com | ool[.]xyz Domain Attacker infrastructure - phishing domain *gpoosl[.]com Domain Attacker infrastructure - phishing domain *groolg[ |
| domain | gprokl.com | sl[.]com Domain Attacker infrastructure - phishing domain *.gprokl[.]com Domain Attacker infrastructure - phishing domain *.gxoosl |
| domain | groolg.com | osl[.]com Domain Attacker infrastructure - phishing domain *groolg[.]com Domain Attacker infrastructure - phishing domain *gcslom[ |
| domain | groonl.com | ozl[.]com Domain Attacker infrastructure - phishing domain *groonl[.]com Domain Attacker infrastructure - phishing domain *gsool[. |
| domain | groosl.com | gl[.]com Domain Attacker infrastructure - phishing domain *.groosl[.]com Domain Attacker infrastructure - phishing domain *.gprokl |
| domain | gsoolg.com | sl[.]com Domain Attacker infrastructure - phishing domain *.gsoolg[.]com Domain Attacker infrastructure - phishing domain *gzoozl[ |
| domain | gsool.space | onl[.]com Domain Attacker infrastructure - phishing domain *gsool[.]space Domain Attacker infrastructure - phishing domain *gbrokl[ |
| domain | gsool.xyz | osl[.]xyz Domain Attacker infrastructure - phishing domain *gsool[.]xyz Domain Attacker infrastructure - phishing domain *gpoosl[ |
| domain | gsoosl.xyz | okl[.]xyz Domain Attacker infrastructure - phishing domain *gsoosl[.]xyz Domain Attacker infrastructure - phishing domain *gsool[. |
| domain | gxoosl.com | kl[.]com Domain Attacker infrastructure - phishing domain *.gxoosl[.]com Domain Attacker infrastructure - phishing domain *.gsoolg |
| domain | gzoozl.com | olg[.]com Domain Attacker infrastructure - phishing domain *gzoozl[.]com Domain Attacker infrastructure - phishing domain *groonl[ |
| ipv4 | 212.73.134.136 | irst malicious login into the victim’s GCP environment from 212.73.134[.]136 , the source IP address of the phishing kit. The threat a |
From the original article
6 min read at wiz.io
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
By Shira Ayal · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.