FROM PHISHING TO LLMJACKING: THREAT ACTORS TARGETING CLOUD BILLING ACCOUNTS FOR LLM USAGE

Summary from the TLDR IT newsletter

Researchers report that threat actors are compromising privileged Google Cloud credentials via phishing campaigns to hijack cloud billing accounts for unauthorized mass AI execution, specifically targeting Gemini API resources. Attackers leverage excessive permissions, modify domain restriction policies, and link external, attacker-controlled projects to victim billing accounts to offload costs. Organizations face rapid financial surges reaching hundreds of thousands of dollars within days while prompt payloads remain hidden in foreign tenants.