LLMjacking: stolen GCP billing accounts pay for attackers' Gemini calls

01What happened

Wiz's Customer Incident Response Team published the analysis on October 20, 2026, written by Shira Ayal and Andre Maccarone. The team traced intrusions whose goal was financial: running large-scale model workloads on the victim's money rather than stealing or destroying data. Victims saw unauthorized Gemini API charges reaching tens to hundreds of thousands of dollars within 24 to 48 hours of initial access.

02How it works

Attackers bought Google search ads for terms such as google cloud and gcp, leading through a Google Sites redirect to a fake Google login page that captured credentials and MFA codes before passing the victim to the real site. Within minutes the kit reused those credentials to sign in. The attackers then enabled the Gemini API in existing low-usage projects, created service accounts with API keys, granted themselves high-privilege roles, deleted the organization policy that restricted IAM membership to company domains, and linked their own projects to the victim's billing account.

03Who is affected

Google Cloud customers whose users can be phished are exposed, and organizations relying on the iam.allowedPolicyMemberDomains organization policy should note that attackers deleted it so they could add external Gmail accounts. Wiz reports the attackers also demoted existing billing administrators to read-only billing viewers, and routed later activity through addresses geolocated in the victim's headquarters country.

04What to do

Hunt Google Workspace, GCP Admin Activity and Cloud Billing audit logs for IAM members on non-corporate domains, changes to organization policies and billing administrators, and unexpected Gemini API enablement or service account key creation in older projects. Set budget spend caps and alert on abnormal API cost surges, and review logins from the indicator address Wiz published.

Questions people ask

Is LLMjacking a flaw in Google Cloud or the Gemini API?

LLMjacking as Wiz describes it exploits no flaw in Google Cloud or the Gemini API. Attackers phished a user's credentials and MFA code, then used ordinary administrative permissions to enable the Gemini API, grant roles and attach their own projects to the victim's billing account. Google removed the malicious search ads after reports, but the technique relies on account takeover rather than a product vulnerability.

How would I notice an LLMjacking intrusion in my own GCP organization?

Abnormal model API spend is the clearest signal, since Wiz saw charges far above baseline within 24 to 48 hours. Wiz also recommends alerting on deletion or modification of the iam.allowedPolicyMemberDomains organization policy, on IAM members from domains such as gmail.com, on billing administrator changes, and on Gemini API enablement or service account key creation inside older, low-usage projects.

Why did the attackers demote the existing billing administrators?

Demoting billing administrators to read-only billing viewers removed the victim's ability to respond. Wiz reports that once the legitimate admins held view-only rights, they could not revoke the attackers' access or detach the rogue projects consuming their budget. Combined with activity routed through addresses geolocated in the victim's headquarters country, the change bought the attackers time to keep running workloads unnoticed.

Sources 2 links, all fetched

1. 1wiz.ioWiz CIRT Analysis
2. 2docs.cloud.google.comGCP Domain Policy Docs