Attackers make Google Cloud users pay for their Gemini use

The Wiz Customer Incident Response Team tells of a new attack on Google Cloud, which it saw in many cases. Attackers get the login of an administrator and connect cloud projects of the attackers to the bill of the victim. They then use the Gemini AI model on a large scale, and the victim pays and cannot see the AI work.

How it works

The attacker buys a Google search ad for “gcp” that leads to a login page. The page copies the Google page and gets the password and the next login code. The attacker deletes the rule that limits access to company domains and adds its Gmail accounts as billing administrators.

The numbers

The attacker connects external projects to the bill. Wiz tells of charges of tens to hundreds of thousands of dollars in 24 to 48 hours. The attackers changed the billing administrators of the company to read only users.

What is not known

The AI work runs in external projects, and the logs of the victim do not show the text sent to the model or its answers. Wiz does not know the use of the AI work. Google Ads removed the ad after it got a report.

Insight: AI capacity is a target for theft

Wiz tells of theft of the bill. Symantec tells that the Aoki malware steals credentials of AI coding tools, which give the API quota (the software access limit) of a developer. These attacks seem to target AI capacity that costs money and not data, and a billing role is a target as much as a password. Leaders must control who can connect a billing account.