Token theft now is an industry: platforms reselling access to LLM using stolen API keys

A growing number of AI token theft cases is leaving developers with staggering financial losses, warn security researchers at Palo Alto Networks Unit 42.

The researchers are observing a shady economy in which access to frontier AI models is sold through account hijacking by developers and other AI users.

On these platforms, dubbed transfer stations, tokens generated by the best AI models can be bought for a fraction of the actual cost.

“The unrelenting frenzy of AI adoption and soaring costs of model access are converging into an irresistible opportunity for cybercriminals,” Unit 42 said in the report.

Regional usage restrictions are cited as one of the main reasons for the massive grey market.

The report lists a few domains hosting transfer station infrastructure, including amutes[.]com and abb1[.]life, both of which appear to be no longer active.

The services are often advertised on Chinese-language marketplaces like Taobao. The sellers act as intermediaries between the official AI providers and end users. However, under the hood, the supposed intermediaries often simply proxy the requests to official APIs using stolen access tokens.

These proxies frequently rotate credentials, apply a layer of obfuscation, and handle billing-model routing and prompt normalization. Their main customers are likely developers seeking low-cost access to AI.

The platforms wouldn’t be profitable if they bought tokens at full price.

“Many operators turn to stolen credentials. Attackers can use privileged corporate developer accounts they’ve harvested via information stealers or through phishing campaigns,” the Unit 42 researchers said.

The stolen accounts are abused to the limit. Attackers create new API keys, remove billing limits, disable critical usage alerts and logging, to leave the actual account holders unsuspecting. Developer AI accounts are available for sale on dark web marketplaces.

Attackers can obtain API keys in many other ways. They scrape improperly secured file shares and code repositories. Even some of the recent NPM supply chain attacks, such as Shai-Hulud and Miasma, in which attackers poison public software packages with malware, contribute to the pool of stolen tokens and credentials.

“The financial impact of token-jacking can be catastrophic,” the researchers warn.

“Transfer stations can generate tens of millions of API calls per day, resulting in hundreds of thousands of dollars in usage fees.”

In one observed case, hackers integrated stolen credentials into a transfer station within minutes, resulting in nearly $1 million in charges before the attack was discovered and contained.

The cost can derail budgets or even force smaller businesses into bankruptcy.

Unit 42.

Cybernews previously reported on many developers going bankrupt due to exposed Google API keys – Unit 42’s report explains how these charges arise.

Users of shady transfer stations are also often deceived – the platforms often route requests to inferior AI models.

“Developers risk having their sessions monitored and mined for sensitive data that could turn them into future victims,” the report warns.

Security researcher Harshal Singh previously warned that shady token shops also use cut-rate Claude access postings as a cover – their actual goal is to attract and log paying traffic, such as prompts, tool calls, accepted code, which itself might be valuable enough and can be resold for LLM training and other use cases.

“Anthropic sells a million Claude Opus input tokens for fifteen dollars. A Taobao seller will sell you the same thing for two or even one. They're not running a sanctioned reseller program, and they're not subsidizing your startup,” the researcher’s post on X reads.

To avoid staggering losses, the researchers urge organizations to protect access keys and implement strict spending limits for AI usage.