Wiz details phishing campaign that hijacks cloud billing for AI use

Cloud security firm Wiz published research on 20 October 2026 describing a campaign in which attackers steal credentials through a malicious Google Search advert, take over the victim's cloud billing account, and then run up large bills on large language model APIs.

In its write-up, Wiz traces the chain from a single advert click to credential theft, to the hijacking of a cloud billing account, and finally to what the company describes as hundreds of thousands of dollars in unauthorised AI API usage. The research is titled "From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage".

LLMjacking is the term used for abuse in which attackers obtain access to someone else's account and then use that account's paid access to large language models, leaving the victim with the bill. Wiz frames the billing account itself as the target here, rather than data stored in the cloud environment.

The starting point, according to Wiz, is a paid search advert. Search advertising has become an attractive delivery route for credential phishing because a sponsored result can sit above the genuine site in a list of search results, and the user arrives at the fake page having searched for the real one rather than having clicked a link in an email.

What makes the billing account a useful prize is straightforward arithmetic. Model inference is metered and billed by usage, so an attacker who controls spending on an account can convert someone else's payment method into compute without needing to breach the victim's applications or data. Wiz puts the cost of the unauthorised usage it observed in the hundreds of thousands of dollars.

The practical lesson for defenders is that cost is now a security signal. An unexplained jump in model API spend, usage from unfamiliar regions, or new API keys issued against a billing account are the kinds of events that would show up in finance dashboards before they show up in a security tool. Organisations running AI workloads may want billing alerts wired into the same alerting path as security alerts, and hard spending caps where the platform supports them.

The same logic applies to the access controls around billing. Permission to change payment details, raise quotas or mint API keys is often held more loosely than permission to read production data, because it has historically been treated as an administrative rather than a security function. This campaign suggests that distinction is no longer safe.

Wiz's published summary does not name the organisations affected, does not say how many victims were involved, and does not attribute the activity to a named group. It also does not specify which cloud providers or model providers were involved, or over what period the unauthorised usage accumulated. The campaign is described as reported research rather than as a vulnerability in any single vendor's product, and no fix or patch is at issue: the underlying weakness is a user being convinced to hand over credentials.

For teams that run agents or other automated systems against hosted models, the exposure is similar. Those workloads tend to hold long-lived API credentials and generate steady, high-volume traffic, which can make malicious usage harder to spot against normal baseline consumption.