From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Threat actors are conducting LLMjacking attacks by luring victims through malicious Google Search ads that lead to phishing sites stealing cloud credentials. Once credentials are compromised, attackers hijack cloud billing accounts to exploit LLM APIs such as those provided by major cloud providers. The unauthorized AI API usage can result in hundreds of thousands of dollars in charges to the victim. The attack chain begins with a simple ad click, progresses through credential theft, and culminates in large-scale abuse of AI services. This campaign highlights the growing financial motivation behind targeting cloud environments for AI resource exploitation. The technique represents an emerging threat vector where cloud-hosted LLM services are monetized by attackers at the victim's expense. Organizations using cloud-based AI services are urged to monitor billing anomalies and enforce strong credential hygiene.