Wiz identified threat actors hijacking Google Cloud Platform (GCP) billing accounts via search-ad phishing to fund unauthorized Gemini API usage. By stealing corporate credentials and MFA tokens, attackers gain access, dismantle IAM domain restrictions, and link external GCP projects to the victim's billing account - racking up tens to hundreds of thousands of dollars in LLM costs while obscuring prompt activity from victim logs.
Attackers use malicious Google Search ads targeting GCP keywords to lead users to phishing pages that harvest credentials and MFA codes. The automated kit logs into GCP via IP 212.73.134.136, then shifts to local IP addresses within the victim's country to evade geolocation alerts. Once inside, attackers target dormant GCP projects, enable the Gemini API, create service accounts with AI administrative roles (roles/ml.admin), and remove organization-level guardrails like iam.allowedPolicyMemberDomains.
Attackers add external @gmail.com accounts to the victim's billing infrastructure, assign roles/billing.admin, and link foreign GCP projects to the victim's billing profile. To prevent recovery, legitimate admins are demoted to read-only viewers. Because all API calls run inside the attacker's external project, prompt contents remain invisible to victim auditing while generating massive financial losses from unauthorized Gemini API execution.