Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
17 IOCs

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Wiz
Wiz
Published October 20, 2026Original Report

Threat Actors

Malware Families

Excerpt

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage | Wiz Blog Wiz Platform Solutions Pricing Resources Customers Company Sign in Under attack? Get a demo Blog From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage Get a demo Contact…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTUREgroolg.comgbrokl.xyzgsoosl.xyzCAPABILITYMETA StealerPlayVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(2)
Victim

Indicators of Compromise

Open the mindmap →

17 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domaingroolg.comHighScore 58/100First seen
Domaingbrokl.xyzHighScore 58/100First seen
Domaingsoosl.xyzHighScore 58/100First seen
Domaingpoosl.comHighScore 58/100First seen
Domaingzoozl.comHighScore 58/100First seen
Domaingboogl.comHighScore 58/100First seen
IP212.73.134.136MediumScore 47/100First seen
Domaingroosl.comHighScore 58/100First seen
Domaingcslom.comHighScore 58/100First seen
Domaingsool.spaceHighScore 58/100First seen
Domaingbrokl.spaceHighScore 58/100First seen
Domaingsool.xyzHighScore 58/100First seen
Domaingcoalg.comHighScore 58/100First seen
Domaingprokl.comHighScore 58/100First seen
Domaingroonl.comHighScore 58/100First seen
Domaingsoolg.comHighScore 58/100First seen
Domaingxoosl.comHighScore 58/100First seen

IOC Relationship Graph

Building graph…