Criminals are stealing the API keys developers use to reach AI services and reselling that access, and the bills land on the victim. Palo Alto Networks' Unit 42 says it has responded to a growing number of these cases, including one where attackers picked up inadvertently exposed credentials and wired them into a resale operation within minutes, running up nearly a million dollars in charges before the theft was discovered and contained.
The technique is called token jacking. An API key, or token, is what lets an application talk to an AI provider without a person logging in each time. Providers bill by the token, the small chunks of text a model reads and writes, and because AI workloads are unpredictable, many do not limit how many tokens an account can consume. They tally usage and invoice on a cycle instead. That combination of limitless scaling by default and a billing lag is what makes a stolen key so profitable, and its theft so easy to miss.
Where the stolen access is sold
Unit 42's report traces the demand to what the market calls transfer stations: gray market vendors selling frontier model access at a fraction of retail, frequently advertised on Chinese-language marketplaces such as Taobao and paid for with anonymous, seller-issued credits. Unit 42 points to an earlier deep dive by a researcher named Harshal Singh for mapping this world. A large number of these storefronts run on just a few open-source proxy platforms, among them new-api and one-api, which handle credential rotation, obfuscation, billing and model routing on the operator's behalf.
Not every buyer is a developer hunting a discount. Unit 42 notes that competing nation-states can use the same proxy services to reach cutting-edge frontier models and train their own at a fraction of what AI development normally costs. Developers who buy in take a risk of their own: their prompts may be routed to inferior models, and their sessions can be monitored and mined for sensitive data.
How the keys are taken
To stay cheap, a transfer station needs a steady supply of discounted legitimate tokens, so operators turn to stolen ones. Unit 42 lists several routes. Attackers use privileged corporate developer accounts harvested through information stealers or phishing, then create new API keys, provision models, remove billing limits and switch off usage alerts and logging. Such accounts are readily available from access brokers on dark web marketplaces. Attackers also mine already-provisioned keys out of improperly secured file shares and code repositories, and more recently out of poisoned, self-propagating npm packages that go on to infect every release the developer builds. Unit 42 singles out the Shai-Hulud and Miasma npm supply chain attacks, whose credential hauls it says could fuel transfer stations for years. IntelFusions has covered the same worm lineage stealing cloud keys from developers, and separately a botnet that hunts exposed AI servers to harvest credentials.
What it costs
Transfer stations can generate tens of millions of API calls per day, which Unit 42 says results in hundreds of thousands of dollars in usage fees. Organizations hit this way have very little recourse to recover funds already billed by the AI service, and Unit 42 warns the cost can derail budgets or even force smaller businesses into bankruptcy.
What you should do
- Implement spending limits for AI usage, and alert when consumption changes drastically from an established baseline.
- Review every privileged account that can provision resources or adjust spending limits.
- Migrate from long-term access keys to short-term bearer tokens to limit the window of damage.
- Put an AI gateway in front of model traffic alongside a machine authentication platform, so every LLM call is tied to a verified, managed machine identity and usage anomalies surface in real time.
- Apply network boundaries to compute resources, so a stolen key cannot simply be called from a transfer station.
- Manage development environments tightly so malicious packages never enter the build pipeline.
The full write-up is in the original Unit 42 report.
Indicators
Unit 42 published indicators tied to recent token jacking activity, kept defanged here. Malicious API calls came from 38[.]46[.]219[.]162, 38[.]46[.]219[.]163, 38[.]46[.]219[.]166, 3[.]235[.]109[.]125 and 47[.]88[.]103[.]81, carrying the user agent Go-http-client/2.0,gzip(gfe). Logins tied to credential theft came from 117[.]72[.]74[.]48, 207[.]246[.]106[.]162 and 95[.]214[.]112[.]26. Transfer station infrastructure includes amutes[.]com and abb1[.]life.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.