Wiz Blog | RSS feed
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
The Wiz Customer Incident Response Team (CIRT) has investigated a rising threat pattern in cloud environments: threat actors hijacking cloud billing accounts to fund unauthorized AI usage. Threat actors are not only using AI as a tool to conduct attacks, they are also compromising victim environments solely to abuse their finances for mass Large Language Model (LLM) execution, incurring hundreds of thousands of dollars in AI API charges.
Sources
- Wiz Blog | RSS feed · 20-Oct-2026