From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Reported 21 Oct 2026 by otx · Severity: medium

Threat actors are conducting sophisticated campaigns targeting Google Cloud Platform environments through phishing attacks via sponsored search ads. Attackers compromise privileged user credentials using fake login pages, then manipulate organizational policies to disable securit