LLMjacking via GCP Phishing: Gemini API Abuse & Cloud Billing Hijack Campaign — OTX Detection Pack

Threat Summary

OTX pulse data published by AlienVault on 2026-10-21 documents an active, multi-stage campaign in which unknown threat actors are monetizing compromised Google Cloud Platform environments through a technique the research community now calls LLMjacking — the theft and resale/abuse of cloud-hosted large language model capacity billed to the victim's account.

The attack chain observed in this campaign proceeds as follows:

1. Phishing via sponsored search ads. Victims searching for Google Cloud or Google AI Studio login portals are served malicious sponsored advertisements that redirect to typosquatted look-alike domains (e.g., groosl.com, gboogl.com, gcoalg.com). These domains host pixel-perfect clones of Google authentication pages.
2. Credential harvesting. Privileged GCP users — organization administrators and project owners — enter credentials on the fake portals. Session tokens and passwords are exfiltrated to attacker infrastructure at IPv4 212.73.134.136.
3. Guardrail suppression. Using the stolen privileged access, attackers manipulate GCP Organization Policies to disable security controls (e.g., service account key creation restrictions, external member restrictions, audit logging constraints).
4. Persistence & API enablement. New service accounts are created with Gemini API (Vertex AI / Generative Language API) access. External attacker-controlled identities are invited into the organization, establishing cross-tenant persistence that survives password resets of the original phished user.
5. Monetization. The attackers run high-volume LLM workloads — often resold access to Gemini endpoints — against the victim's billing account, producing direct financial theft via cloud billing hijack and, in some cases, cross-tenant exploitation of AI resources.

This represents the convergence of classic credential phishing economics with the emerging AI-resource-abuse threat class. The financial impact model mirrors cryptojacking but at LLM inference price points, which are orders of magnitude higher per token-hour.

Threat Actor / Malware Profile

Attribution: Unknown actor. No named malware family is used — this is a malware-free intrusion relying on social engineering and native cloud APIs (LotC — Living off the Cloud). This makes traditional endpoint detection largely blind and shifts detection weight to identity, DNS, and cloud control-plane telemetry.

Distribution method: Sponsored search advertisements (malvertising) placed on major search engines, targeting keywords such as "google cloud console login," "ai studio," and "gemini api." Ads link to a rotating set of typosquatted domains registered in bulk (note the shared gbrokl pattern across .space and .xyz TLDs — a registration-behavior fingerprint useful for proactive discovery).

Payload behavior: The "payload" is a phishing kit serving cloned Google SSO pages. Post-compromise, the actor uses legitimate GCP tooling (gcloud CLI, REST calls to iam.googleapis.com, serviceusage.googleapis.com, aiplatform.googleapis.com) to:

• Create service accounts and mint keys
• Bind overly permissive roles (roles/owner, roles/aiplatform.admin)
• Enable the Generative Language / Vertex AI APIs on victim projects
• Add external members to organization-level IAM policies

C2 communication: Credential exfiltration to 212.73.134.136. Post-exploitation "C2" is indistinguishable from legitimate Google API traffic — detection must key on behavioral anomalies (API enablement events, org policy modifications, external principal additions), not network signatures.

Persistence: Attacker-controlled external accounts invited into the GCP organization; newly created service accounts with keys. Both survive victim credential rotation.

Anti-analysis: Use of legitimate Google infrastructure for monetization; phishing domains rotate quickly; sponsored ad placement gives the lure inherent credibility that bypasses user suspicion and some secure email/web gateway heuristics.

IOC Analysis

The pulse contains 17 indicators dominated by typosquat domains plus one exfiltration IPv4:

• Domains (typosquat / phishing infrastructure): groosl.com, groonl.com, gboogl.com, gbrokl.space, gbrokl.xyz, gcoalg.com, gcslom.com, and 10 additional indicators of the same class. These imitate Google properties via character substitution (groosl ≈ google-adjacent visual confusion, gboogl, gcoalg).
• IPv4: 212.73.134.136 — credential collection / phishing kit hosting.

Operationalization guidance for SOC teams:

1. DNS & proxy enforcement: Push all domains and the IPv4 into DNS sinkhole, SWG/proxy blocklists, and firewall egress rules immediately. Also alert on historical DNS resolutions (last 90 days) — a single resolution event by a privileged user is a potential confirmed compromise.
2. Fuzzy-domain hunting: Feed the observed patterns (gbrokl*, g*gl.com, g**l.com character-substitution permutations) into dnstwist or similar permutation engines to pre-emptively discover unlisted sibling domains; monitor Certificate Transparency logs for new certs matching Google-look-alike patterns.
3. Identity-layer pivoting: IOCs alone will not catch post-compromise activity. Pivot to Google Workspace / GCP audit logs for logins from unusual ASN/geography followed by org policy or IAM changes within minutes — the campaign's signature temporal pattern.
4. Ad-platform telemetry: Where possible, capture referrer chains in proxy logs showing arrival via paid search results (gclid parameters, googleadservices.com redirects) to identify the malvertising delivery vector.

Detection Engineering

---
title: GCP Organization Policy Tampering Followed by Service Account Creation
id: 7f3a2c91-llmj-4001-a001-orgpolicytamper
status: experimental
description: Detects modification of GCP organization policies (guardrail suppression) followed by service account creation or key minting — the core LLMjacking post-compromise sequence observed in the Gemini API abuse campaign.
author: Security Arsenal Threat Intel
date: 2026/10/21
logsource:
    product: gcp
    service: auditlog
    category: admin_activity
detection:
    selection_policy:
        protoPayload.methodName|contains:
            - 'SetOrgPolicy'
            - 'orgpolicy.policies.create'
            - 'orgpolicy.policies.update'
    selection_iam:
        protoPayload.methodName|contains:
            - 'google.iam.admin.v1.CreateServiceAccount'
            - 'google.iam.admin.v1.CreateServiceAccountKey'
            - 'SetIamPolicy'
    condition: selection_policy or selection_iam
    timeframe: 30m
level: high
tags:
    - attack.defense_evasion
    - attack.t1562
    - attack.persistence
    - attack.t1098
falsepositives:
    - Legitimate IaC pipelines (Terraform) performing org policy changes from known service accounts
---
title: External Principal Added to GCP Organization IAM Policy
id: 7f3a2c91-llmj-4002-a002-externalprincipal
status: experimental
description: Detects an external (non-organization-domain) user or group being granted roles in GCP IAM policy bindings — cross-tenant persistence technique used in the LLMjacking phishing campaign.
author: Security Arsenal Threat Intel
date: 2026/10/21
logsource:
    product: gcp
    service: auditlog
    category: admin_activity
detection:
    selection:
        protoPayload.methodName: 'SetIamPolicy'
    filter_internal:
        protoPayload.serviceData.policyDelta.bindingDeltas.member|contains:
            - '@yourcompany.com'
            - 'serviceAccount:'
    condition: selection and not filter_internal
level: critical
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1136
falsepositives:
    - Approved third-party vendor access grants (maintain allowlist of partner domains)
---
title: Generative AI API Enablement on GCP Project
id: 7f3a2c91-llmj-4003-a003-geminiapienable
status: experimental
description: Detects enablement of Vertex AI / Generative Language (Gemini) APIs on GCP projects where AI services are not part of standard operations — a strong LLMjacking indicator when correlated with recent phishing exposure.
author: Security Arsenal Threat Intel
date: 2026/10/21
logsource:
    product: gcp
    service: auditlog
    category: admin_activity
detection:
    selection:
        protoPayload.methodName|contains:
            - 'serviceusage.services.enable'
        protoPayload.request.name|contains:
            - 'aiplatform.googleapis.com'
            - 'generativelanguage.googleapis.com'
    condition: selection
level: medium
tags:
    - attack.impact
    - attack.t1496
falsepositives:
    - Developer teams legitimately onboarding AI workloads (baseline per-project API inventory)

// Hunt: LLMjacking phishing infrastructure access + anomalous GCP control-plane activity
// Run across endpoint DNS telemetry and identity logs (90-day lookback for historical exposure)
let PhishIOCs = dynamic(["groosl.com","groonl.com","gboogl.com","gbrokl.space","gbrokl.xyz","gcoalg.com","gcslom.com"]);
let PhishIP = "212.73.134.136";
let DNSEvents =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (PhishIOCs) or RemoteIP == PhishIP
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName
    | extend ExposureType = "Phishing Infrastructure Access";
// Correlate: any user who touched phishing infra AND later shows Cloud AI API activity
let ExposedUsers = DNSEvents | distinct InitiatingProcessAccountName;
DNSEvents
| union (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where AccountName in~ (ExposedUsers)
    | where FileName in~ ("gcloud.exe","gcloud","gsutil.exe","gsutil","curl.exe","curl")
    | where ProcessCommandLine has_any ("iam service-accounts create","service-accounts keys create","services enable","set-iam-policy","aiplatform","generativelanguage","org-policies")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
    | extend ExposureType = "Suspicious Cloud Control-Plane Tooling"
)
| sort by TimeGenerated asc

# LLMjacking IOC & Artifact Hunt — run on endpoints used by GCP administrators
# Checks DNS cache, browser history artifacts, gcloud CLI presence, and active connections

$PhishDomains = @("groosl.com","groonl.com","gboogl.com","gbrokl.space","gbrokl.xyz","gcoalg.com","gcslom.com")
$PhishIP = "212.73.134.136"
$Findings = @()

Write-Host "[*] Checking DNS client cache for phishing domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $PhishDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $Findings += [pscustomobject]@{Type="DNS Cache"; Indicator=$d; Detail=($hit | Out-String).Trim()} }
}

Write-Host "[*] Checking active & historical TCP connections to exfil IP..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $PhishIP }
if ($conns) { $Findings += [pscustomobject]@{Type="Network Connection"; Indicator=$PhishIP; Detail=($conns | Select-Object LocalPort,State,OwningProcess | Out-String).Trim()} }

Write-Host "[*] Checking for gcloud CLI + recently created service account key artifacts..." -ForegroundColor Cyan
$gcloudPaths = @("$env:APPDATA\gcloud","$env:USERPROFILE\.config\gcloud","$env:LOCALAPPDATA\Google\Cloud SDK")
foreach ($p in $gcloudPaths) {
    if (Test-Path $p) {
        $recentKeys = Get-ChildItem -Path $env:USERPROFILE -Recurse -Include "*.json" -ErrorAction SilentlyContinue -Depth 3 |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) -and (Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match '"type":\s*"service_account"' }
        if ($recentKeys) { $Findings += [pscustomobject]@{Type="Service Account Key File"; Indicator=$p; Detail=($recentKeys.FullName -join '; ')} }
    }
}

Write-Host "[*] Checking browser history (Chrome/Edge) for phishing domain visits..." -ForegroundColor Cyan
$histPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History","$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History")
foreach ($h in $histPaths) {
    if (Test-Path $h) {
        $tmp = "$env:TEMP\hist_$(Get-Random).db"
        Copy-Item $h $tmp -Force -ErrorAction SilentlyContinue
        foreach ($d in $PhishDomains) {
            $raw = [System.IO.File]::ReadAllText($tmp)
            if ($raw -match [regex]::Escape($d)) { $Findings += [pscustomobject]@{Type="Browser History"; Indicator=$d; Detail=$h} }
        }
        Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "[!] POTENTIAL EXPOSURE DETECTED — escalate to IR immediately" -ForegroundColor Red
    $Findings | Format-List
} else {
    Write-Host "[+] No LLMjacking phishing artifacts found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0–4 hours):

• Block all listed typosquat domains and 212.73.134.136 at DNS, proxy, and egress firewall layers.
• Query historical DNS/proxy logs (90 days) for any resolution of the IOC domains — prioritize hits from users holding GCP Owner/Org Admin roles.
• Review GCP audit logs for the campaign's signature sequence: SetOrgPolicy → CreateServiceAccount/CreateServiceAccountKey → SetIamPolicy with external members → services.enable on aiplatform.googleapis.com / generativelanguage.googleapis.com.
• Pull Gemini/Vertex AI usage and billing telemetry for unexplained inference spikes.

24 hours:

• Force credential resets and revoke all sessions/OAuth grants for any user whose endpoint touched phishing infrastructure — assume credential theft given the credential-harvesting lure design.
• Enumerate all service accounts and keys created in the last 90 days; disable unrecognized keys and remove any external principals from IAM bindings at organization, folder, and project level.
• Verify MFA enforcement (preferably phishing-resistant FIDO2/passkeys) on all privileged cloud identities.
• File abuse reports with search ad platforms for the malicious sponsored listings.

1 week:

• Enforce Organization Policy constraints proactively: iam.disableServiceAccountKeyCreation, iam.allowedPolicyMemberDomains (restrict to your Workspace customer ID), and restrict serviceusage.services.enable via custom roles.
• Deploy DNS-layer protective filtering with typosquat heuristics; stand up CT-log monitoring for Google-look-alike certificate registrations.
• Implement budget alerts and per-project Gemini API quotas so abuse triggers paging before five-figure billing accrues.
• Run targeted user-awareness sessions on sponsored-ad phishing for cloud admin and finance personas — the exact demographic this campaign selects for.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub