Wiz: Google Ads Phishing Leads to GCP Takeover and Gemini LLMjacking Billed to the Victim

Google Cloud organizations whose administrators clicked search ads for "google cloud" or "gcp"

Wiz CIRT described an adversary-in-the-middle kit that captured credentials and MFA codes. The attackers enabled the Gemini API on dormant projects and created service accounts with `roles/ml.admin` and `roles/mcp.toolUser`. They deleted the org-level `iam.allowedPolicyMemberDomains` policy, added Gmail accounts as billing admins, and demoted existing billing admins to viewers. They then linked attacker-owned projects to the victim's billing account, so Gemini usage was billed to the victim while the prompts stayed outside the victim's logs. Victims saw tens to hundreds of thousands of dollars in charges within 24-48 hours. Single source

Phishable MFA on cloud admin accounts, and billing accounts that accept usage from projects outside the organization once an admin role is granted