When LLMjacking Becomes a Cloud Billing Breach
Updated October 21, 2026 · first published October 21, 2026
A compromised cloud administrator can turn your billing account into a funding source for someone else’s AI workloads. Wiz reported incidents on October 20, 2026 in which attackers phished privileged Google Cloud users, attached attacker-controlled projects to victims’ billing accounts, and drove tens to hundreds of thousands of dollars in Gemini API charges within 24–48 hours. Calls ran in external projects, leaving victims with the bill but no visibility into prompts or outputs.
The attack crossed four control planes
The lure was a sponsored search ad for Google Cloud administration. A fake login captured credentials and MFA codes, then redirected the user to the real sign-in flow. Attackers enabled Gemini API, created service accounts and keys, weakened organization policies, added external identities, granted billing administration, and linked their projects to the victim’s billing account. Treat the sequence as one incident; each change can look routine alone.
Why cost dashboards alone are not enough
API calls, keys, prompts, and outputs lived in foreign projects. The victim’s bill could spike while its workload logs offered no explanation. Wiz says charges reached tens to hundreds of thousands of dollars within one or two days. This is an identity compromise with a billing consequence, not just a token anomaly. A spend alert can limit the financial blast radius; it cannot revoke a stolen administrator or remove an attacker’s access.
Hunt for the control-plane changes
Correlate Google Workspace login events, GCP Admin Activity, and Cloud Billing audit logs. Prioritize suspicious sign-ins followed by changes to iam.allowedPolicyMemberDomains, external principals, billing-account IAM, project-to-billing links, Gemini API enablement, and new service-account keys in dormant projects. Put identity, timestamp, source network, project, and billing account into one timeline. Watch for unexpected roles/billing.admin grants.
Make containment and cost controls work together
Separate billing administration from routine project administration. Require phishing-resistant MFA and just-in-time elevation; alert on external principals and organization-policy changes. Restrict which projects can attach to billing where possible. Set AI-usage and billing alerts, use spend caps where eligible, and name an on-call owner who can revoke access and pause workloads. A cap is a circuit breaker, not a guaranteed invoice ceiling; see the Google Cloud spend-cap guide. Preserve logs, revoke compromised sessions and keys, remove unauthorized principals, restore policies, and then detach attacker-controlled projects after checking service impact. Add credential containment to the LLM spend-spike runbook.
FAQ
Can attackers charge Gemini API usage to another company’s bill?
Wiz documented cases where attackers linked their own Google Cloud projects to victims’ billing accounts. The victim paid while workload activity stayed in external projects.
Will a billing alert stop LLMjacking?
No. It signals unusual spend but does not revoke identities or stop requests. Pair it with identity controls, scoped billing permissions, and a rehearsed containment runbook.
Which logs should we check first?
Correlate privileged sign-ins with organization-policy changes, external IAM principals, billing-role changes, new project links, Gemini API enablement, service-account keys, and the resulting cost spike.
Sources
Related
Related
Want this applied to your stack? Bring the provider bills, gateway logs, and top workflows; we will map the cost drivers and savings path. Book a free audit →