# From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Phishing harvested GCP admin creds, attacker stripped org domain policy, linked foreign projects to victim billing, and ran mass Gemini API inference billed to victims.

- Payout: Real-world hack
- Severity: high
- Program: Google
- Analysis by: Wiz Research
- Disclosed: 2026-10-20
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/from-phishing-to-llmjacking
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking
- Tags: area:cloud domain:cloud impact:funds-loss impact:internal-access kind:incident platform:threat-intel sev:high tech:gcp technique:chained vuln:account-takeover vuln:misconfiguration vuln:privilege-escalation

**Target:** GCP IAM, org policy, and Cloud Billing
**Root cause:** Compromised privileged GCP credentials allowed deletion of iam.allowedPolicyMemberDomains and granting of roles/billing.admin to external accounts, enabling attacker projects to be linked to victim billing.
**Steps:**
1. Phish GCP admin via sponsored search ad -> Google Sites redirect -> fake Google login capturing creds+MFA, then redirect to real login
2. Log in from `212.73.134[.]136`, reauthenticate from second IP
3. In low-usage projects: enable Gemini API, create service accounts with API keys, assign `roles/ml.admin` and `roles/mcp.toolUser`
4. Delete org policy `iam.allowedPolicyMemberDomains` to allow external domains
5. Add attacker Gmail accounts to billing account; grant `roles/billing.admin` and `roles/recommender.billingAccountCudAdmin`
6. Link attacker-controlled external GCP projects to victim billing account
7. Demote existing internal billing admins to read-only billing viewer to block remediation
8. Run high-volume Gemini API inference from foreign projects, billed to victim
**How found:** Incident response across multiple intrusions; Wiz CIRT correlated anomalous logins, org policy deletions, external-domain IAM members, Gemini API enablement in stale projects, and abnormal billing surges.
**Exploitation:** After credential phishing and MFA capture, attacker used excessive privileges to remove domain restrictions, add external accounts as billing admins, and attach foreign projects to the victim's billing account. All Gemini API key generation and inference ran inside attacker tenants, so victims paid tens to hundreds of thousands of dollars within 24-48h while logs showed no prompt content.
**Escalation:** Chained phishing -> IAM policy removal -> external account addition -> billing admin grant -> cross-tenant project linking; demoted legitimate admins to prevent revocation.
**Insight:** Watch for org-policy deletions like iam.allowedPolicyMemberDomains and billing.admin grants to non-corporate domains; attackers hide LLM abuse in foreign linked projects so cost anomalies, not prompt logs, are the detection signal.