Phishing ads lead to hijacked Google Cloud billing for Gemini use, Wiz says
Wiz’s incident response team says attackers bought Google Search ads for terms like “google cloud” that led to a fake Google sign-in page, which captured passwords and MFA codes. With that access, they lifted a domain restriction, made outside Gmail accounts billing admins and linked their own projects to the victims’ billing accounts. Victims were charged tens to hundreds of thousands of dollars for Gemini API use within 24 to 48 hours.
- Versions
- Not applicable: no software flaw is involved.
- Vendor
- Published
- Editor
- Austin Simas
Details
The phishing kit signed in to the victim’s Google Cloud environment at once from , and the attacker signed in again minutes later from a second address. Later activity came from addresses in the victim’s home country, Wiz says. Google flagged the first sign-in as suspicious and emailed the user, and Google Ads has removed the ad campaign.
In existing, little-used projects, the attacker enabled the Gemini API, created service accounts with Gemini API keys and gave them roles such as roles/ml.admin. They deleted organization policies such as iam.allowedPolicyMemberDomains, which limits IAM membership to company domains. Then they made outside accounts billing admins and cut the real admins to read-only billing viewers.
Because the AI work ran in the attackers’ own projects, victims paid for it, but their logs show nothing of the prompts or the outputs, Wiz says.
What to do
6 steps
- 1 Search Google Workspace sign-in events and Google Cloud audit logs for activity from 212.73.134[.]136 and for sign-ins Google flagged as suspicious.
Indicators
IPs and domains copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Phishing kit’s address for the first sign-in, per Wiz | |
| Domain | Phishing domain, listed by Wiz with a wildcard for subdomains | |
| Domain | Phishing domain, listed by Wiz with a wildcard for subdomains | |
| Domain | Phishing domain, listed by Wiz with a wildcard for subdomains | |
| Domain | Phishing domain, listed by Wiz with a wildcard for subdomains | |
| Domain | Phishing domain, listed by Wiz with a wildcard for subdomains | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard | |
| Domain | Phishing domain, listed by Wiz with a leading wildcard |
- IP addressPhishing kit’s address for the first sign-in, per Wiz
- DomainPhishing domain, listed by Wiz with a wildcard for subdomains
- DomainPhishing domain, listed by Wiz with a wildcard for subdomains
- DomainPhishing domain, listed by Wiz with a wildcard for subdomains
- DomainPhishing domain, listed by Wiz with a wildcard for subdomains
- DomainPhishing domain, listed by Wiz with a wildcard for subdomains
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
- DomainPhishing domain, listed by Wiz with a leading wildcard
Sources
- Wiz Customer Incident Response TeamPrimary source wiz.io