AI Token Jacking Steals API Keys, Costs Victims Nearly $1 Million

Key Takeaways

• A new threat, “AI token jacking,” involves attackers stealing API keys for AI services.
• These stolen keys are used to consume expensive AI model services, leading to significant, often unnoticed, charges for victims.
• Attackers leverage various methods to acquire credentials, including phishing, malware, exposed repositories, and poisoned software packages.
• Victims have faced nearly $1 million in unauthorized charges before detecting the compromise.
• Mitigation requires immediate key revocation, strict spending limits, enhanced monitoring, and secure software supply chain practices.

The burgeoning field of artificial intelligence is attracting a new wave of cybercrime: AI token jacking. This sophisticated form of abuse enables malicious actors to seize API keys, subsequently exploiting victims’ accounts to access costly AI model services. The consequence for unsuspecting organizations is often a substantial, unexpected bill.

The methods employed by attackers to obtain these critical developer credentials are diverse and persistent. They range from well-known tactics such as targeted phishing campaigns and the deployment of information-stealing malware to exploiting vulnerabilities in exposed file shares, public code repositories, or even by injecting malicious code into software packages. Once compromised, these keys become a conduit for illicit proxy services that consume paid AI capacity, all at the victim’s expense.

Analysts at Unit 42 have observed a significant increase in these incidents, highlighting the potential for severe financial losses that can accrue rapidly, often within minutes. A recent Palo Alto Networks report reveals that attackers have managed to incur nearly $1 million in charges using inadvertently exposed credentials before the victims could identify and mitigate the ongoing abuse.

The financial risk stems from the operational model of many AI providers, who typically bill for usage after the fact, rather than implementing real-time controls that might flag unusual activity. Furthermore, account scaling often proceeds with minimal limits, creating an environment where criminals can execute automated workloads or resell access without immediate detection. This delay leaves the legitimate account holder liable for the accumulated expenses.

AI Token Jacking: The Mechanics of API Key Theft

An API key functions as a digital credential, granting software the ability to interact with a service without requiring repeated user authentication. In the context of large language models (LLMs), charges are frequently based on “tokens”—small units of text processed by the model. Consequently, a stolen API key represents direct purchasing power, far more than just a simple login secret.

Unit 42’s investigation links much of this nefarious activity to “transfer stations”—gray-market services that act as intermediaries between users and legitimate AI platforms. These services are designed to rotate credentials, route API requests, and bill customers using their own credit pools. Some aggressively advertise discounted access to premium AI models, providing a lucrative avenue for reselling stolen API keys.

The research team documented incidents where this illicit infrastructure generated tens of millions of API calls daily, quickly pushing the associated fees into the hundreds of thousands of dollars. To maintain their low-cost offerings, these operators require a continuous supply of discounted or illicitly obtained credentials. They often exploit privileged developer accounts to create new keys, activate additional models, circumvent spending limits, or suppress alert notifications.

This underlines the critical need for organizations to treat any exposed AI credentials with extreme urgency, similar to the high-profile case involving a stolen Gemini key that rapidly led to substantial unauthorized costs. The report also identified poisoned, self-spreading npm packages as a particularly concerning vector for compromise. Once a developer installs such a package, it can exfiltrate credentials from the development environment and potentially infect subsequent code releases, expanding the pool of available keys. Recent reports on malicious npm package theft illustrate how supply-chain attacks can simultaneously target developer, cloud, and AI credentials.

Limiting the Financial Blast Radius

According to the researchers, organizations often have limited recourse for recovering funds once an AI provider has billed for consumed resources. This financial impact can be particularly devastating for smaller businesses. Victims are advised to immediately review model usage and billing records, revoke all exposed keys, and thoroughly investigate account activity to pinpoint the origin and scope of suspicious requests.

What You Should Do

• Implement Spending Limits: Establish strict spending caps on AI services that align with normal operational use.
• Configure Usage Alerts: Set up automated alerts to notify administrators when AI resource consumption deviates significantly from established baselines.
• Audit Privileged Accounts: Regularly review all privileged accounts capable of provisioning AI resources or modifying billing controls.
• Adopt Short-Lived Tokens: Replace long-lived API keys with short-lived bearer tokens wherever feasible to minimize the window of exposure.
• Enforce Managed Identities: Ensure that every machine interacting with AI services has a verified and managed identity.
• Establish Network Boundaries: Implement robust network segmentation around compute resources to prevent compromised credentials from being freely exploited by external transfer stations.
• Secure Development Environments: Scrutinize all dependencies and build pipelines, block untrusted package releases, and regularly scan code repositories and shared storage for inadvertently exposed secrets.
• Regularly Rotate Credentials: Implement a routine schedule for rotating all AI credentials, especially after any suspected exposure.

Ultimately, AI token jacking thrives when powerful credentials are left unprotected and resource usage goes unchecked. Rapid key revocation, realistic spending controls, granular access permissions, and stringent software supply-chain security practices are essential to prevent escalating costs and mitigate the impact of this emerging threat.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.