LLMjacking: Attackers Hijack Cloud Billing to Run Up Huge AI Bills

Wiz's Customer Incident Response Team has investigated a growing threat pattern known as LLMjacking. Rather than only using AI to carry out attacks, criminals are breaking into cloud environments just to spend the victim's money on mass Large Language Model (LLM) usage. In the cases Wiz investigated, this ran up AI charges of hundreds of thousands of dollars. The research focuses on campaigns targeting Google Cloud Platform (GCP).

The attack began with phishing through paid search ads. The attacker bought Google Search ads for common terms such as "google cloud" and "gcp". Clicking the ad led users through a Google Sites redirect to a fake Google login page. Victims entered their passwords and multi-factor authentication (MFA) codes, which the phishing kit captured before sending them back to the real Google login. Being asked to sign in twice likely looked like a minor glitch. In reality, the kit immediately used the stolen details to log in to the victim's GCP environment. Google Ads has since removed the malicious campaign after reports.

Once inside with privileged credentials, the attackers linked external GCP projects they controlled to the victim's internal billing accounts. Because the AI workloads ran in those foreign projects, the victim could not see the prompts or outputs, so the purpose of the usage remained unknown. Wiz says its full write-up covers the wider attack lifecycle and offers threat hunting guidance to detect this activity.