OTX Threat: From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Threat actors are conducting sophisticated campaigns targeting Google Cloud Platform environments through phishing attacks via sponsored search ads. Attackers compromise privileged user credentials using fake login pages, then manipulate organizational policies to disable security guardrails. They create service accounts with Gemini API access, invite external attacker-controlled accounts, and ass