LLMjacking: The Billing Account Is the Payload

LLMjacking: The Billing Account Is the Payload

LLMjacking monetises your cloud bill instead of stealing your data. Wiz's incident responders traced a GCP campaign from a purchased Google Search ad to attacker projects linked to the victim's billing account. The harvest took credentials and MFA codes; six-figure Gemini charges followed inside 48 hours, with every prompt invisible to the victim. The chain, the economics, and the billing-side runbook.

The ad click that opened a billing account

The initial access was advertising, per Wiz's 20 October disclosure. Threat actors bought Google Search ads for administrative terms such as "google cloud" and "gcp". A click led through a Google Sites redirect to a fake Google login page.

Users with valid console access typed credentials and MFA codes into the phishing page. The kit captured both, then redirected the victim to the genuine Google authentication prompt, so the second sign-in looked like a glitch. The kit's own IP, 212.73.134[.]136, performed the first malicious login immediately. The actor re-authenticated minutes later from a second IP used for the rest of the activity. Google removed the campaign after reports.

What the attackers did inside GCP

No new infrastructure. The actors picked existing low-usage GCP projects and did three things, according to Wiz. They enabled the Gemini API product, created service accounts holding Gemini API keys, and added those accounts to high-privilege roles such as roles/ml.admin and roles/mcp.toolUser.

Low-usage projects are ideal camouflage. Their baseline activity is near zero, their alert thresholds are loose, and nobody opens them. The attacker inherits a trusted tenant instead of building one.

The foreign-project trick

Then came the move that shapes the whole attack: the actors linked external, attacker-controlled GCP projects directly to the victim's internal billing account. That establishes cross-tenant charging, so every API request running in the attacker's project bills the victim automatically.

Because the workloads executed in foreign projects, prompt contents and model outputs stayed entirely out of the victim's logging. Within 24 to 48 hours of initial access, affected organisations saw unexpected charges reach tens to hundreds of thousands of dollars in unauthorised Gemini usage. The surge over baseline compute spend showed up in billing while security logs stayed quiet.

The economics of stolen inference

Sysdig's Threat Research and Response team coined LLMjacking in May 2024 for exactly this pattern. The definition, per Sysdig's own history of the term: stolen cloud credentials, paid AI models, victim's bill. The scale has grown since.

METR disclosed a stolen API key used for three weeks to consume roughly $600,000 in granted credits, Hackread reports. And according to CrowdStrike's 2026 Threat Hunting Report, one campaign pushed nearly 200,000 API requests through a compromised account's model access in two minutes. The fuel is abundant: Truffle Security found 2,863 public Google API keys with Gemini access embedded in client-side code, and new GCP keys default to unrestricted.

Why ordinary controls miss it

Valid credentials produce valid traffic. The billing link is an administrative act rather than a network anomaly. The workloads run in someone else's tenant, so EDR sees nothing, API logs see nothing, and audit trails see a normal user.

Our OpenCode breach breakdown shows the same detection inversion at platform scale: the billing page caught the attack, not the security stack. In our eval environments guide we treat synthetic credentials as the only safe default for the same reason. A real billing relationship inside agent reach is attack surface, and running model-generated work behind production guardrails only helps once the bill is capped.

The billing-side runbook

1. Lock billing association with organisation policy: projects may join approved billing accounts only, and linking foreign projects requires break-glass approval. The Wiz chain stalls completely when the link is denied.
2. Alert on billing administration as well as spend: billing IAM changes, project-to-billing links, and service-account key creation inside dormant projects.
3. Enforce phishing-resistant authentication for console identities; the kit captured MFA codes in real time, so code-based factors do not defend this chain.
4. Audit roles/ml.admin and roles/mcp.toolUser assignments and Gemini API keys in low-usage projects, and treat a new key in a dormant project as an incident.
5. Set budgets with programmatic action attached, caps or automatic disablement, so a 24-to-48-hour six-figure window becomes a minutes-long four-figure one.
6. Restrict API keys by default, since unrestricted keys authenticate to Gemini whether they were meant to or not. It is the same default-deny logic our zero-public-ip playbook applies to network reach.

Verdict, and the caveats on this page

Our verdict: LLMjacking flips the motive from data to money, and money moves through billing links that most organisations never monitor. Watch billing administration like you watch authentication, deny foreign project links, and make MFA phishing-resistant; the chain then breaks before step three.

• Wiz's disclosure describes GCP campaigns from its incident-response caseload; however, the mechanic generalises to any cloud where billing links across tenants. The GCP focus is a limitation of the sample, not of the threat.
• The dollar figures are case-scoped: Wiz's tens-to-hundreds of thousands in 48 hours, and METR's $600,000 was granted credit, not cash paid, so the numbers do not sum.
• Google removed the specific ad campaign, but the tactic of buying search ads for administrative terms cannot be removed. The double-authentication trick needs no ad platform at all.
• In our fleet, billing lives at the control plane and workloads run behind egress allowlists, so we can describe the posture and cannot share victim-side telemetry.

FAQ

What is LLMjacking?

The abuse of stolen cloud or API credentials to run paid AI models on someone else's account. Sysdig's TRT coined the term in May 2024. Unlike data theft, the payload is money: the attacker consumes inference and the victim pays. Wiz's latest GCP cases extend the pattern by linking attacker projects to victim billing, so the usage never appears in the victim's own project logs.

How did attackers get in without malware?

Through advertising. Per Wiz, actors bought Google Search ads for terms like "google cloud" and phished credentials and MFA codes with a fake login. The page redirected victims to the real Google prompt afterwards, and the actors signed in with the harvested session. No exploit and no implant: an authenticated user with billing rights was the entire requirement.

Will my cloud logs show LLMjacking in time?

Usually not. In the Wiz cases the requests ran inside attacker-controlled projects, so prompt content and outputs stayed outside victim monitoring and only the charges surfaced. The detectable events are administrative: project-to-billing links, new service-account keys, and role grants such as ml.admin. Alert on those, and attach programmatic action to spend budgets.

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "LLMjacking: The Billing Account Is the Payload",
      "datePublished": "2026-10-21",
      "dateModified": "2026-10-21",
      "author": {"@type": "Organization", "name": "Krova Cloud Engineering"},
      "publisher": {"@type": "Organization", "name": "Krova Cloud"},
      "mainEntityOfPage": "https://krova.cloud/blog/llmjacking-billing-account-hijack"
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "What is LLMjacking?",
          "acceptedAnswer": {"@type": "Answer", "text": "The abuse of stolen cloud or API credentials to run paid AI models on someone else's account. Sysdig's TRT coined the term in May 2024. Unlike data theft, the payload is money: the attacker consumes inference and the victim pays. Wiz's latest GCP cases extend the pattern by linking attacker projects to victim billing, so the usage never appears in the victim's own project logs."}
        },
        {
          "@type": "Question",
          "name": "How did attackers get in without malware?",
          "acceptedAnswer": {"@type": "Answer", "text": "Through advertising. Per Wiz, actors bought Google Search ads for terms like \"google cloud\" and phished credentials and MFA codes with a fake login. The page redirected victims to the real Google prompt afterwards, and the actors signed in with the harvested session. No exploit and no implant: an authenticated user with billing rights was the entire requirement."}
        },
        {
          "@type": "Question",
          "name": "Will my cloud logs show LLMjacking in time?",
          "acceptedAnswer": {"@type": "Answer", "text": "Usually not. In the Wiz cases the requests ran inside attacker-controlled projects, so prompt content and outputs stayed outside victim monitoring and only the charges surfaced. The detectable events are administrative: project-to-billing links, new service-account keys, and role grants such as ml.admin. Alert on those, and attach programmatic action to spend budgets."}
        }
      ]
    }
  ]
}