Phishers bought 'gcp' search ads, billed their own Gemini projects to victims' Google Cloud accounts, and demoted the admins who could unplug them

Wiz Research title card: From Phishing to LLMjacking, beside a hooded figure at a laptop — Image: wiz.io

The ad said Google, and the login page looked like Google. According to Wiz’s incident response team, the attacker bought Google Search ads for “google cloud” and “gcp,” sent clickers through a Google Sites redirect to a fake sign-in page, and collected passwords and MFA codes. The page then bounced each victim to the real Google prompt to sign in again. “Forced to authenticate a second time, the user likely assumed the initial attempt was a minor glitch,” write Wiz’s Shira Ayal and Andre Maccarone.

The phishing kit logged in with those credentials right away. Inside, the attacker switched on the Gemini API in old, quiet projects and minted service accounts with Gemini keys. Then they deleted the organization policy iam.allowedPolicyMemberDomains, the setting that keeps IAM membership inside the company’s own domains, and added outside Gmail accounts to the billing account. Admin roles such as roles/billing.admin went to those accounts or to the phished users, Wiz says.

The payoff move came next. They linked their own Google Cloud projects to the victim’s billing account, so every Gemini request made over there was charged over here. Because that work ran in someone else’s projects, Wiz says “prompt contents and model outputs remained completely hidden from the victim organization.”

Then came the lockout. The attackers demoted the company’s existing billing admins to read-only billing viewers, which Wiz says “stripped legitimate administrators of their ability to revoke permissions or detach rogue projects directly from the console.” After the first login, their traffic came from IP addresses in each victim’s home country, even when that didn’t match where the phished employee actually was.

Within 24 to 48 hours, Wiz says, victims were looking at “tens to hundreds of thousands of dollars in unauthorized Gemini API usage.” Wiz calls the goal “non-destructive financial exploitation.” Think of somebody adding themselves as an authorized user on your credit card, then changing your login so you can only read the statement.

The whole chain ran on Google: Google’s ads, a Google Sites redirect, Google Cloud, Gemini. Wiz has belonged to Google Cloud since March 11, so this report comes from Google’s own security unit. The only word on the ads is one line in it: “Following reports of this activity, Google Ads has taken action to remove the malicious ad campaign.” Google did flag the odd login and email the user a security alert, Wiz says. What happened to the bills, Wiz doesn’t say.

Why it matters

The bill is the only evidence. The prompts and outputs lived in the attackers’ projects. Luděk Svoboda, who looks after Google Cloud at the Czech IPTV company ModernTV and lived through the same kind of attack, found a second blind spot: linking a project to a billing account is logged in that project, so when the project belongs to another organization, “the event never shows up in your own audit logs.”

The keys to the meter are handed out casually. Google’s billing access docs say Billing Account Administrator can “link and unlink projects, and manage other user roles on the billing account.” That’s the whole attack in one role. The smaller Billing Account User role also links projects, and Google’s advice on it is that it “has very restricted permissions, so you can grant it broadly.”

A cap stops one meter at a time. The Gemini API has monthly spend caps, and Svoboda’s stopped Gemini at about $100,000. Compute Engine on the same account kept running. A regular Cloud Billing budget won’t save you either: Google’s own budget docs say an alerts-only budget “doesn’t automatically cap Google Cloud or Google Maps Platform usage or spending.”

Svoboda’s case shows what this looks like from the inside. He posted the timeline on Google’s developer forums on October 13. “It was not a leaked API key: the attacker used an already signed-in admin session,” he wrote. On May 30, through that session, the attacker gave itself a billing administrator role and added two outside accounts as billing admins. The admin had passkeys, but no new sign-in happened, so they never came into play.

Google flagged the session the next morning and signed it out. The billing changes stayed. From June 2 to 10, thirteen projects from four other organizations ran A100 and H100 GPUs and the Gemini API on a billing account that had spent at most about $7 a month since 2022. The total landed “in the high six figures (USD), in about eight days,” he says.

The console listed 28 cost anomalies on that account, half of them above 1,000 percent. “We had 28 anomalies listed there and not one notification reached us,” Svoboda wrote in a second post. The same actor also linked one of ModernTV’s projects to billing accounts that weren’t ModernTV’s, turned on Gemini and made API keys, so other companies are probably being billed too. His way in differs from the ad trick, and neither write-up ties the two cases together. The steps after the first login match: outside billing admins, foreign projects, Gemini on the meter.

Steal this

If you run a Google Cloud billing account, open Billing, then Account management, and read the list of linked projects today. One you can’t name is the attack in progress. Kind of like finding a phone on your family plan that nobody in the family owns.
When you check IAM on a billing account, remove any principal outside your company’s domain, especially a gmail.com address, and confirm iam.allowedPolicyMemberDomains is still set at the organization level. Wiz says the attackers deleted that policy before they invited anyone in.
Before you trust an email alert, open Billing, then Cost management, then Anomalies in the console and read the list yourself. Svoboda had 28 anomalies listed and no notification about any of them. This is like checking the smoke detector by looking at it instead of waiting for the beep.
If a billing account sits dormant, close it or remove its payment method. Svoboda’s had spent about $7 a month for years, which made it an ideal target.

Pay-per-token AI makes this kind of theft unusually clean. A stolen login used to turn into data that had to be sold, and a stolen card into goods that had to be fenced. Gemini time on somebody else’s bill is used up the moment it’s taken, and the victim’s own logs show nothing but the charge. Expect billing accounts to get the scrutiny that sign-ins got a decade ago, starting with who holds the billing admin role and who can link projects.

A reply under Svoboda’s thread asks the question Google hasn’t answered there yet: “Is there a way to stop projects from outside our own organization from being linked to our billing account in the first place?”

More Security