AI Token Jacking: Enterprises Must Secure AI Resources

Businesses must be more mindful of their AI resources. A new research shows a growing trend of AI credentials being stolen as AI usage is scaling across enterprises.

The research, conducted by Palo Alto’s Unit 42, dives deeper into the mechanism of how attackers are hijacking legitimate AI access tokens and routing them through gray-market “transfer stations” to monetise access to expensive frontier AI models.

“Third parties acting as intermediaries between official AI providers and end users sell these transfer stations. Many of these advertisements appear on Chinese-language marketplaces like Taobao. They promise access to multiple AI services with seller-issued custom credits that are purchased anonymously. Earlier this year, a researcher named Harshal Singh posted a fascinating deep dive into this world,” according to the research.

“For transfer stations to be cost-effective, their operators require access to a large pool of discounted legitimate tokens for each frontier AI model offered. Purchasing tokens at full price to simply resell them at a discount isn’t profitable, so many operators turn to stolen credentials,” it added.

The research further notes that so many operators turn to stolen credentials as buying tokens at full price and selling them is not a profitable business. Malicious users can also use privileged corporate developer accounts they’ve harvested via information stealers or through phishing campaigns.

“More recently, attackers have stolen these keys using poisoned, self-propagating npm packages downloaded by unsuspecting developers. Once installed, these packages infect any other code releases the developer builds. They steal credentials and access tokens from each environment along the way, amplifying the impact,” researchers added.

Familiar playbook, higher stakes

The concept of token jacking isn’t something new; when cloud adoption was growing, attackers would compromise cloud instances and mine cryptocurrency using the computer resources, and it was called Cryptojacking, experts tell Entrepreneur India.

API credential theft is a similar concept; however, the impact is much more than just abuse but leads to data compromise and leakage as loss resulting in compliance fines and loss of trust.

The compromise techniques are still the same, using old-school techniques like phishing and installation of malware, screengrabbers, etc. As AI agent developers hard-coded API tokens in the code, attackers using the installed malware get access to the secret keys. 

The usage of these tokens is not monitored proactively if these AI requests are going through a common gateway. Automated bot scrapers monitor GitHub/GitLab commits for hardcoded keys pushed accidentally.

Cdr Raj Shastrakar (retd), Director, Head Unit 42, India & SAARC, tells Entrepreneur India that AI token jacking takes a familiar problem — stolen credentials — and adds a powerful financial incentive for attackers.

If an attacker steals an organization’s AI access key, they can use it to run large volumes of AI queries while the legitimate account owner picks up the bill. 

With advanced AI models becoming more expensive and access restricted in some markets, a lucrative gray market has emerged where “transfer stations” resell access at discounted rates using stolen credentials.

“We have seen cases where stolen keys were put to use within minutes, with charges reaching nearly USD 1 million before the activity was detected and stopped,” he said.

Roshmik Saha, Chief Technology Officer at Skyflow, adds that there’s an additional dimension here: developers who unknowingly use gray-market transfer stations risk having their prompts monitored and mined — meaning anything sent through those pipelines, customer queries, internal data, business logic embedded in prompts, is potentially exposed to an intermediary whose incentives are entirely opaque.

“Beyond direct financial loss from illicit compute billing, what additional legal, regulatory, or data-privacy risks do organizations face when unauthorized third parties route queries through their compromised enterprise AI tokens,” Prateek Bhajanka, cybersecurity expert, asks.

“Beyond the direct financial loss, there is a huge legal and compliance risk as the malicious use of AI tokens by illegitimate users can lead to cyber attacks, corporate espionage, and the accountability would be traced back to the company who bought the subscription,” he added.

Figure 1. Advertisement for gray-market frontier model access.

Speed of Breach

What’s alarming for enterprises is the rapid speed of the credential transition from dev ecosystem to active resale networks. 

According to Vivek Kumar, a cybersecurity and technology leader, notes that developer environments are the softest target in this whole chain – and the path in isn’t just one thing anymore. Some of it is still classic: phishing, infostealer malware sitting on a developer’s laptop harvesting whatever credentials it can find. 

“But what worries me more is how automated it’s gotten. We’re now seeing self-propagating npm packages – Shai-Hulud and Miasma are the two Unit 42 called out – that crawl through CI/CD pipelines, repos, and file shares looking for exposed keys, and they pull them out without a human attacker lifting a finger,” he said. 

“And once a key’s been grabbed, it moves fast – Unit 42’s own research found stolen credentials getting plugged into a transfer station within minutes of being exposed. That’s really the crux of the problem: by the time anyone on a security team notices unusual activity, the token’s already been resold and is being used somewhere else entirely,” he added.

Shastrakar further explains that the Unit42 team observed self-propagating worms such as “ChainDrop,” “Shai-Hulud,” and “Miasma” automatically harvesting tokens at scale.

These tokens are then instantly exfiltrated to attacker-controlled infrastructure, validated against the AI provider’s billing limits, and programmatically plugged into the backend of gray-market transfer stations. 

This allows attackers to monetize stolen computing power within minutes, often before a security team can detect the breach or revoke the compromised credentials.

Figure 2. Webpage from a transfer station site with prices for different AI models.

What Enterprises Must Do

Experts suggest that organizations should avoid long-term static credentials for their AI infrastructure and instead adopt just-in-time access mechanisms. They should also place AI gateways between developers and external AI platforms to centrally manage and proxy credentials, ensuring developers never handle raw tokens directly in their local environments or CI/CD pipelines. 

To secure the perimeter around these resources, teams should tightly manage privileged accounts, enforce strict network boundaries such as IP allowlisting so tokens can only be used from authorized corporate infrastructure, and implement hard spending and usage limits that trigger immediate alerts if consumption deviates drastically from the baseline.

Organizations also need tighter controls over the software packages developers install, since malicious packages can be used to steal credentials. The basic principle is straightforward: give people and systems only the access they need, and remove that access when it is no longer required.

“To manage the unpredictable financial liability of variable AI consumption, C-suite leaders and CFOs must shift from traditional retrospective auditing to real-time “AI FinOps” and proactive governance. This requires implementing centralized AI gateways that can enforce hard spending quotas and automated kill switches to instantly halt anomalous usage spikes,” Shastrakar of Palo Alto adds.

He also suggests that business and technology leaders also need clear ownership over AI spending, defined limits on consumption and alerts when usage suddenly moves outside normal patterns. 

“They should also be able to understand which teams, applications and accounts are driving that spending. The potential exposure is significant: We have seen transfer stations generate tens of millions of API calls a day, while individual token-jacking incidents have produced charges approaching USD 1 million. AI security and AI spending therefore need to be governed together rather than treated as separate issues.”