Unit 42 Reports Rising AI Token Theft Through Gray-Market Proxies
Summary
Unit 42 reports a rise in AI token jacking, in which attackers steal developer API keys for use or resale through gray-market proxies, driving large bills. It describes credential-theft routes and recommends spending controls, short-term tokens and AI gateways.
Key points
- Unit 42 says it has responded to cases where stolen credentials were added to transfer stations within minutes; one case led to nearly $1 million in charges before discovery and containment.
- Transfer stations use proxy software such as new-api and one-api to route access to official AI services, often reselling it at discounted prices.
- The article describes token theft through phishing, infostealers, compromised developer accounts, exposed repositories or file shares, and poisoned npm packages, including campaigns named Shai-Hulud and Miasma.
- Attackers with privileged developer accounts may create API keys, remove billing limits, or disable usage alerts and logging.
- Unit 42 warns that transfer-station users risk having prompts monitored, potentially exposing sensitive information.
- Recommended safeguards include spending limits and anomaly alerts, reviewing privileged accounts, using short-term tokens and AI gateways, and securing development environments.
Article Details
- Event Type
- Reported surge in AI token jacking, in which attackers steal legitimate API keys and use or resell access through gray-market transfer stations.
- Impact
- Unit 42 reports significant financial losses, including cases with nearly one million dollars in charges before discovery and containment. Transfer stations can generate hundreds of thousands of dollars in usage fees quickly, and users risk exposure of prompts and other sensitive data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abb1[.]life | Domain identified as transfer station infrastructure used in token jacking activity. |
| DOMAIN | amutes[.]com | Domain identified as transfer station infrastructure used in token jacking activity. |
| IPV4 | 104[.]243[.]42[.]117 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 116[.]105[.]166[.]148 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 117[.]72[.]74[.]48 | IP address associated with malicious logins linked to credential theft. |
| IPV4 | 15[.]204[.]106[.]173 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 172[.]96[.]142[.]186 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 198[.]255[.]70[.]210 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 207[.]246[.]106[.]162 | IP address associated with malicious logins linked to credential theft. |
| IPV4 | 23[.]236[.]182[.]215 | IP address associated with malicious logins linked to credential theft. |
| IPV4 | 23[.]237[.]196[.]170 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 3[.]235[.]109[.]125 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 38[.]46[.]219[.]162 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 38[.]46[.]219[.]163 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 38[.]46[.]219[.]166 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 47[.]251[.]72[.]239 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 47[.]88[.]103[.]81 | IP address associated with malicious API calls in token jacking activity. |
| IPV4 | 95[.]214[.]112[.]26 | IP address associated with malicious logins linked to credential theft. |
MITRE ATT&CK
T1040 · Network SniffingThe article says transfer station operators may monitor and mine users’ sessions and prompts for sensitive data.T1078 · Valid AccountsStolen legitimate developer API keys and accounts are reused for unauthorized access to AI services.T1195.001 · Compromise Software Dependencies and Development ToolsPoisoned, self-propagating npm packages steal credentials and access tokens from developer environments.T1552.001 · Credentials In FilesAttackers mine API keys from improperly secured file shares or code repositories.T1566 · PhishingThe article reports that attackers obtain developer accounts through phishing campaigns.