Wiz: Hackers hijack cloud billing accounts to fund mass Gemini API use

Phishing through sponsored search ads

Wiz CIRT says the attacks began with a familiar tactic. The threat actor bought Google Search ads for common administrative terms such as “google cloud” and “gcp”. A user who clicked the malicious ad was sent through a Google Sites redirect to a fake Google login page.

Victims with valid access to Google Console entered their credentials and multi-factor-authentication (MFA) codes on that page. The site captured them and then redirected the user back to the real Google authentication prompt. Wiz notes that the user, forced to sign in a second time, likely assumed the first attempt was a minor glitch.

Meanwhile, the automated phishing kit used the stolen details to make the first malicious login from 212.73.134[.]136, the kit's source IP address. The attacker signed in again a few minutes later from a second IP address, which was then used for the rest of the GCP activity. According to Wiz, Google Ads has removed the malicious campaign after reports. Google also flagged the login as suspicious and sent alert emails, but Wiz advises organizations not to rely on user awareness alone and to monitor Google Workspace User Log Events for suspicious login flags and anomalous re-authentication triggers.

Removing guardrails and moving the bill

Once inside, the attacker used the compromised account's excessive privileges to prepare the billing setup for abuse. Rather than build new infrastructure, they targeted existing, low-usage GCP projects. There they:

• enabled the Gemini API product
• created service accounts with Gemini API keys
• added those service accounts to high-privilege roles such as roles/ml.admin and roles/mcp.toolUser

The attacker then deleted organization-level safety policies such as iam.allowedPolicyMemberDomains. That policy restricts Identity and Access Management (IAM) membership to verified company domains, so removing it allowed external personal accounts to receive access and high-privilege permissions. The compromised user then added attacker-controlled Gmail accounts to the organization's billing account and assigned administrative roles, including roles/recommender.billingAccountCudAdmin on projects and roles/billing.admin on billing accounts.

The roles/billing.admin role gives full control of a billing account, including managing permissions, attaching external projects and altering payment settings. The attacker used it to link external, attacker-controlled GCP projects to the victim's billing account. This cross-tenant link means API requests run in the attacker's projects are charged to the victim, while prompt payloads stay invisible to the victim's log monitoring.

Evading detection and locking out admins

Wiz CIRT reports two evasion techniques. After the initial login, later activity came from IP addresses located in each victim organization's headquarters country, even when that did not match the compromised user's real location. This is designed to avoid location-based alerts.

The attackers also demoted existing internal billing administrators to read-only billing viewers. That removed their ability to revoke permissions or detach the rogue projects from the console.

The goal was non-destructive financial exploitation. Because API key generation, prompts and outputs all happened in foreign tenants, victims carried the financial responsibility but, as Wiz puts it, internal security and audit logs gave “no visibility into the nature, content, or context of the AI workloads being executed.” The charges were a sharp surge from the organizations' established baseline compute spend.

What defenders can do

Wiz recommends hunting across Google Workspace, GCP Admin Activity and Cloud Billing audit logs. Its guidance includes:

• reviewing IAM for users with external domains, especially non-corporate providers such as @gmail.com
• checking audit logs for changes to organization policy controls, especially allowedPolicyMemberDomains, and for IAM changes involving billing account administrators
• looking for unexpected Gemini API enablement, service account creation and service account API key creation in old projects
• monitoring abnormal cost surges in API usage and potentially enforcing spend cap budgets

Wiz also lists phishing domains used in the campaign, including *.gboogl[.]com, *.groosl[.]com and *.gprokl[.]com. For GCP customers, the findings point to a practical lesson: billing permissions and organization policies deserve the same monitoring as workload access, and old, rarely used projects can serve as cover for abuse. Wiz customers can use dedicated queries and Threat Intel Center advisories, and the company offers CIRT support for those who suspect a breach.