11 minhigh
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
Unit 42 reports a growing trend of 'token jacking' where cybercriminals steal AI API keys from developers via info stealers, phishing, exposed repositories, and poisoned npm packages. These stolen tokens are used to fuel gray-market 'transfer station' proxy services that resell AI computing access at discounted rates, generating tens of millions of API calls per day and causing catastrophic financial losses for victim organizations. The attack exploits the default limitless scaling and cyclical billing model of AI API providers, meaning victims may not discover the theft until massive charges have accrued.
Sens:▲ 24h
Showing defanged values
- domainabb1[.]lifeTransfer station infrastructure domain used to host proxy services reselling stolen AI API access
- domainamutes[.]comTransfer station infrastructure domain used to host proxy services reselling stolen AI API access
- ip104[.]243[.]42[.]117IP address associated with malicious API calls in token jacking activity
- ip116[.]105[.]166[.]148IP address associated with malicious API calls in token jacking activity
- ip117[.]72[.]74[.]48IP address associated with malicious login activity for credential theft in token jacking campaign
- ip15[.]204[.]106[.]173IP address associated with malicious API calls in token jacking activity
- ip172[.]96[.]142[.]186IP address associated with malicious API calls in token jacking activity
- ip198[.]255[.]70[.]210IP address associated with malicious API calls in token jacking activity
- ip207[.]246[.]106[.]162IP address associated with malicious login activity for credential theft in token jacking campaign
- ip23[.]236[.]182[.]215IP address associated with malicious login activity for credential theft in token jacking campaign
- ip23[.]237[.]196[.]170IP address associated with malicious API calls in token jacking activity
- ip3[.]235[.]109[.]125IP address associated with malicious API calls in token jacking activity
- ip38[.]46[.]219[.]162IP address associated with malicious API calls in token jacking activity
- ip38[.]46[.]219[.]163IP address associated with malicious API calls in token jacking activity
- ip38[.]46[.]219[.]166IP address associated with malicious API calls in token jacking activity
- ip47[.]251[.]72[.]239IP address associated with malicious API calls in token jacking activity
- ip47[.]88[.]103[.]81IP address associated with malicious API calls in token jacking activity
- ip95[.]214[.]112[.]26IP address associated with malicious login activity for credential theft in token jacking campaign
Detection / Hunteropenrouter
What Happened
Cybercriminals are stealing API keys that developers use to access popular AI services like OpenAI and Anthropic, then reselling that stolen access through underground marketplaces called 'transfer stations.' These transfer stations act as middlemen, selling AI computing power at a fraction of the real cost to buyers who may include rival nation-states or budget-conscious developers. The criminals steal the keys through malware, phishing, exposed code files, or by hiding malicious code inside popular software packages that developers download. Because AI providers often don't limit usage and bill on a monthly cycle, victims can rack up hundreds of thousands of dollars in charges before realizing their keys were stolen. Organizations should set spending limits on AI accounts, use short-lived access tokens instead of permanent keys, monitor for unusual API usage, and carefully vet software packages used in development.
Key Takeaways
- Attackers are stealing AI API tokens (keys) from developers via info stealers, phishing, exposed code repositories, and poisoned npm packages to fuel gray-market 'transfer station' proxy services that resell AI access at a fraction of retail cost.
- Transfer stations running open-source software like new-api or one-api act as proxies, handling credential rotation, billing, and model routing while obfuscating the original stolen token source.
- Financial impact can be catastrophic — Unit 42 has responded to cases where stolen credentials were integrated into transfer stations within minutes, resulting in nearly a million dollars in charges before discovery.
- npm supply chain campaigns such as Shai-Hulud and Miasma have stolen massive numbers of credentials that could fuel transfer stations for years.
- Mitigations include implementing spending limits, migrating to short-term bearer tokens, using AI gateways with machine authentication, and tightly managing development environments to prevent malicious package ingestion.
Affected Systems
- AI platform API services (OpenAI, Anthropic, Google AI, Azure AI, AWS Bedrock)
- Developer environments using npm package ecosystems
- Cloud developer accounts with API key provisioning privileges
- Code repositories and file shares containing exposed API credentials
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers steal AI API tokens via info stealers, phishing, exposed code repositories, or poisoned npm packages (e.g., Shai-Hulud, Miasma)
- Credential Harvesting: Stolen developer credentials and API keys are collected from compromised environments, including CI/CD pipelines and development machines
- Infrastructure Setup: Stolen tokens are integrated into transfer station proxy services running open-source software like new-api or one-api
- Monetization: Transfer stations resell AI access at discounted rates on gray-market platforms, generating tens of millions of API calls per day
- Impact: Victim organizations incur massive financial charges on cyclical billing cycles, often discovering the theft only after hundreds of thousands of dollars in damages
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. The article includes a list of IOCs (IPs, domains, user-agent string) in Table 1 that can be used to build custom detections. Palo Alto Networks product references are mentioned but no rule content is included.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect npm package installation of malicious packages and credential theft behavior on developer endpoints, but may have limited visibility into API key exfiltration if it occurs over encrypted channels or through legitimate-looking API client tools. |
| Network Visibility | High | Network monitoring can detect anomalous outbound API calls to AI provider endpoints from unexpected source IPs, unusual volumes of API traffic, and connections to known transfer station infrastructure IPs and domains listed in the article. |
| Detection Difficulty | Moderate | Detecting stolen API key usage requires monitoring API call patterns, billing anomalies, and traffic to known transfer station infrastructure. The provided IOCs enable straightforward blocking, but detecting novel transfer station domains or legitimate-looking API traffic from new locations requires behavioral analysis. |
Required Log Sources
- Cloud provider API audit logs (e.g., AWS CloudTrail, Azure Activity Logs)
- AI platform usage/billing logs
- Network flow data and proxy logs
- EDR process execution and file creation logs on developer endpoints
- npm package installation logs from CI/CD pipelines
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for outbound HTTPS connections to AI provider API endpoints originating from IPs outside your organization's known IP ranges, which may indicate stolen API keys being used from transfer station infrastructure. | Network flow logs, proxy logs, cloud API audit logs | Monetization / Exfiltration | Medium — legitimate remote developers or third-party integrations may generate API calls from unfamiliar IPs |
| Consider hunting for sudden spikes in AI API token consumption or billing that deviate significantly from established baselines, which may indicate stolen keys being used at scale by transfer stations. | AI platform billing/usage dashboards, cloud cost management logs | Impact | Low — large sudden usage increases are unusual for legitimate workloads and warrant investigation |
| Consider hunting for the specific User-Agent string 'Go-http-client/2.0,gzip(gfe)' in outbound API calls to AI provider endpoints, as it has been associated with malicious API calls in token jacking activity. | Web proxy logs, network firewall logs with HTTP headers | Monetization | Medium — this user-agent may be used by legitimate Go-based HTTP clients |
| Consider hunting for npm package installations in CI/CD pipelines or developer machines that match known supply chain attack patterns (T1195.002), particularly packages that attempt to access credential files or environment variables after installation. | CI/CD pipeline logs, EDR process execution logs, package manager audit logs | Initial Access / Credential Harvesting | Low to Medium — legitimate packages rarely access credential stores; however, some development tools may read environment variables for configuration |
| Consider hunting for DNS resolutions and HTTP connections to the known transfer station domains and IPs listed in the article, which may indicate developers in your organization are using these services or that stolen keys are being used from these infrastructures. | DNS logs, web proxy logs, firewall logs | Infrastructure Setup / Monetization | Low — these IPs and domains are specifically identified as malicious infrastructure |
Control Gaps
- Traditional endpoint security may not detect credential theft from developer configuration files or environment variables if no known malware signature is involved
- Network security controls may not flag legitimate-looking HTTPS API calls to AI provider endpoints even when volume is anomalous
- Cloud IAM policies may allow overly broad API key creation and billing limit removal without additional approval or alerting
- CI/CD pipeline security may lack runtime monitoring of npm package behavior post-installation
- Billing alerting may not be configured to detect rapid cost accumulation before monthly cycle completion
Key Behavioral Indicators
- Unusual volume of API calls to AI provider endpoints from a single account or key outside normal business hours
- API key creation or billing limit removal by developer accounts that were recently compromised or show signs of credential theft
- npm packages that access credential files, environment variables, or token stores immediately after installation
- Outbound connections to known transfer station infrastructure IPs or domains (amutes.com, abb1.life, and listed IPs)
- User-Agent string 'Go-http-client/2.0,gzip(gfe)' in API calls to AI provider endpoints
- Developer accounts disabling usage alerts, logging, or billing limits in rapid succession
False Positive Assessment
Medium — The User-Agent string 'Go-http-client/2.0,gzip(gfe)' may be used by legitimate Go-based HTTP clients. Some listed IPs could be shared cloud infrastructure. However, the transfer station domains and credential-theft IPs are more specific and likely to have lower false positive rates. Behavioral detections based on API usage volume spikes will require tuning to organizational baselines.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing all AI platform API keys in your environment for unauthorized usage patterns, especially keys associated with developer accounts that may have been exposed in known credential theft campaigns.
- Consider blocking the listed malicious IPs and domains at your network perimeter and proxy layers if your security tooling supports it.
- If your AI platform supports it, consider immediately implementing spending limits on all API keys and enabling alerts for usage that deviates from established baselines.
- Consider rotating any API keys that may have been exposed in code repositories, file shares, or CI/CD environments, especially if associated with developer accounts showing signs of compromise.
Infrastructure Hardening
- Evaluate migrating from long-term API access keys to short-term bearer tokens to limit the potential window of damage if a key is stolen.
- Consider implementing an AI gateway with centralized API key management to remove credentials from developer environments and build systems.
- If supported by your cloud provider, consider implementing network boundaries that restrict API key usage to specific IP ranges or corporate infrastructure only.
- Consider reviewing all privileged accounts that can provision AI resources or adjust spending limits, and evaluate whether additional approval workflows or MFA should be required for these actions.
- Consider enabling cloud identity security monitoring (e.g., CIEM, ITDR) to detect compromised cloud identities associated with AI API key management.
User Protection
- Consider implementing runtime security monitoring for CI/CD pipelines to detect malicious npm package behavior post-installation.
- If your endpoint security tooling supports it, consider enabling discovery and governance of AI artifacts and code packages on developer endpoints to identify risky or malicious items.
- Consider evaluating whether your organization's endpoint security can detect credential theft from developer configuration files and environment variables.
Security Awareness
- Consider incorporating awareness training on the risks of using gray-market 'transfer station' AI services, including the risk of prompt interception, data mining, and model substitution.
- Consider reminding developers never to commit API keys or credentials to code repositories or store them in unsecured file shares.
- Consider rolling into existing security awareness programs guidance on vetting npm packages before installation, especially new or low-reputation packages.
- If applicable, consider educating development teams on the financial impact of token jacking and the importance of reporting suspicious API usage immediately.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Initial Access
Tactic
Credential Access
Tactic
Lateral Movement
Additional IOCs
- Ips:
38[.]46[.]219[.]163- IP address associated with malicious API calls in token jacking activity38[.]46[.]219[.]162- IP address associated with malicious API calls in token jacking activity23[.]237[.]196[.]170- IP address associated with malicious API calls in token jacking activity15[.]204[.]106[.]173- IP address associated with malicious API calls in token jacking activity104[.]243[.]42[.]117- IP address associated with malicious API calls in token jacking activity198[.]255[.]70[.]210- IP address associated with malicious API calls in token jacking activity47[.]88[.]103[.]81- IP address associated with malicious API calls in token jacking activity47[.]251[.]72[.]239- IP address associated with malicious API calls in token jacking activity
- Other:
Go-http-client/2.0,gzip(gfe)- User-Agent string associated with malicious API calls in token jacking activity
