1. Wiz Oct 20, 2026
   

   Attack

   Attackers hijack victims' Google Cloud billing accounts to pay for massive LLM usage.

   • Initial access goes through Google Search ads on "google cloud" and "gcp" leading to a fake login page.

   • GCP projects controlled by the attackers are linked to the victim's billing account.

   • The prompts and the model responses therefore remain invisible to the victim organization.

   • According to Wiz CIRT, the charges reach tens to hundreds of thousands of dollars in 24 to 48 hours.

   Read the original article From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage wiz.io

Back to the weekBack to the month