IncidentsWiz details phishing campaign that hijacks cloud billing for AI use
Researchers say a single click on a Google Search advert can end with stolen credentials and hundreds of thousands of dollars in unauthorised AI API charges.
20 Oct 2026
Phishing Campaign Hijacks Cloud Billing Accounts for LLM API Abuse
Wiz researchers detailed a campaign in which a Google Search ad click leads to credential theft, allowing attackers to hijack victims' cloud billing accounts and rack up hundreds of thousands of dollars in unauthorized LLM API usage ('LLMjacking').
Disclosed 20 October 2026 · Record updated 20 October 2026
Impact
Threat actors stole cloud billing credentials via phishing and used compromised accounts to incur hundreds of thousands of dollars in unauthorized LLM API usage.
Our coverage
IncidentsSources
- wiz.iohttps://wiz.io/blog/from-phishing-to-llmjacking