Wiz Details GCP Attacks That Hijack Cloud Billing for Unauthorized LLM Use
Summary
Wiz CIRT describes GCP intrusions in which attackers phished privileged users, linked attacker-controlled projects to victims’ billing accounts, and drove unauthorized Gemini API charges reaching tens to hundreds of thousands of dollars.
Key points
- Attackers used sponsored search ads and fake Google login pages to steal GCP credentials and MFA codes; Google removed the reported ad campaign.
- They abused privileged access to enable Gemini APIs, create service accounts and API keys, and remove organization policy restrictions on external IAM members.
- Attackers added external accounts and linked their own GCP projects to victims’ billing accounts, shifting API costs to victims while keeping prompts and outputs in foreign projects.
- Wiz CIRT observed attackers change login IP locations to blend in with victims’ countries and demote internal billing administrators to read-only roles.
- Victims reportedly incurred tens to hundreds of thousands of dollars in unauthorized Gemini API charges within 24 to 48 hours.
- Wiz recommends reviewing Workspace and GCP audit logs for suspicious logins, external IAM members, policy and billing-role changes, API enablement, and service-account key creation; it also recommends monitoring for unusual API spending.
Article Details
- Attack Vectors
- Sponsored Google Search ads led users through a Google Sites redirect to fake Google login pages that captured credentials and MFA codes.
- Using compromised privileged GCP credentials, the actors altered organization IAM policies, added external accounts, elevated permissions, created Gemini API service accounts and keys, and linked attacker-controlled GCP projects to victim billing accounts.
- Actors shifted subsequent activity to IP addresses geolocated in each victim organization's headquartered country and demoted internal billing administrators to read-only roles.
- Defensive Notes
- Monitor Google Workspace User Log Events for suspicious login flags and anomalous re-authentication.
- Review GCP IAM for external users, particularly accounts using non-corporate email providers, and audit organization-policy and billing-administrator changes.
- Investigate unexpected Gemini API enablement, service-account and API-key creation in older projects, and external projects linked to billing accounts.
- Monitor abnormal API costs and consider enforcing spend-cap budgets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gboogl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gbrokl[.]space | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gbrokl[.]xyz | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gcoalg[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gcslom[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gpoosl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gprokl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | groolg[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | groonl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | groosl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gsool[.]space | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gsool[.]xyz | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gsoolg[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gsoosl[.]xyz | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gxoosl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| DOMAIN | gzoozl[.]com | Wildcard domain listed as attacker infrastructure used for phishing. |
| IPV4 | 212[.]73[.]134[.]136 | Source IP of the phishing kit's initial malicious login into a victim GCP environment. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing page captured users' account credentials and MFA codes.T1078.004 · Cloud AccountsActors used harvested valid cloud-account credentials to log in to victim GCP environments.T1098.001 · Additional Cloud CredentialsActors created service accounts and granted them privileged roles including roles/ml.admin and roles/mcp.toolUser.T1098.003 · Additional Cloud RolesActors added external accounts to billing access and assigned administrative billing roles.T1098.005 · Device RegistrationActors created Gemini API keys for newly created service accounts.T1537 · Transfer Data to Cloud AccountActors linked their external GCP projects to victim billing accounts so usage in those projects was charged to the victims.T1562.001 · Disable or Modify ToolsActors deleted the organization-level iam.allowedPolicyMemberDomains safety policy to remove a domain-membership restriction.T1566.002 · Spearphishing LinkActors purchased sponsored search ads that led users to phishing pages impersonating Google login.
Vendors
Products
Gemini APIEnable the Gemini API productGoogle Cloud Platformdemonstrating this pattern, with this blogpost focusing specifically on campaigns targeting Google Cloud Platform (GCP) infrastructure. In these attacks, threat actors compromised privileged GCP user credentialsGoogle SearchThe attack began with a classic yet efficient phishing tactic. The threat actor purchased Google Search ads for common administrative search terms such as “google cloud” and “gcp”. When a user clicked the malicious ad,Google Sitesterms such as “google cloud” and “gcp”. When a user clicked the malicious ad, they were led through a Google Sites redirect to a fake Google login web page. Victim users with valid access to Google Console proceededGoogle Workspacesuch intrusions early, organizations should not rely on user awareness alone, but ingest and monitor Google Workspace User Log Events for suspicious login flags and anomalous re-authentication triggers.