Phishers bought 'gcp' search ads, billed their own Gemini projects to victims' Google Cloud accounts, and demoted the admins who could unplug them
Attackers phished Google Cloud logins through search ads, linked their own projects to the victims' billing accounts, and ran up Gemini bills in the hundreds of thousands of dollars.