Stolen AI API Keys Become a Billing and Abuse Risk
Unit 42 says cybercriminals are stealing developer API keys for AI platforms and using them to consume or resell model access. The security team describes the activity as token jacking, an AI-focused version of stealing access to paid computing resources. The reported impact is not limited to account compromise: victims can face large usage bills before they detect the abuse. The report also links the demand for stolen keys to gray market proxy services known as transfer stations.Why AI keys have become high-value targets
AI API keys are attractive because they provide programmatic access to paid model services without requiring an interactive login each time. Unit 42 describes these keys as tokens used by legitimate developers to access popular AI platforms, and says their theft can give attackers a path to consume model resources under a victim account.
The economics are different from many older cloud abuse cases. Large language model usage is commonly measured in tokens, with providers tallying input and output consumption during a billing cycle. Unit 42 notes that newer and more complex AI models can cost more per token, while some accounts are configured to avoid usage interruptions rather than enforce strict consumption limits. That combination can allow an attacker to run up charges before the account owner sees the bill.
For defenders, the practical implication is that an AI key should be treated like a high-value cloud credential, not like a disposable developer convenience. If a key can provision model traffic at scale, the risk includes both data exposure and direct financial loss.
Transfer stations create demand for stolen tokens
Unit 42 links token jacking to gray market services called transfer stations, which act as intermediaries between official AI providers and end users. The report says these services sell access to multiple AI systems through custom seller-issued credits and may appear on Chinese-language marketplaces such as Taobao.
The technical layer is often a proxy platform. Unit 42 names open-source projects such as new-api and one-api as software used by many transfer stations to route requests to official AI APIs, handle real credential rotation and normalize prompts. To offer model access cheaply, operators need a supply of legitimate tokens below retail cost. The report says many turn to stolen credentials because buying tokens at full price and reselling them at a discount would not be profitable.
This matters because the victim may not be the transfer station user. A developer who never interacts with a gray market service can still pay for its activity if their exposed key is added to a proxy pool. The abuse path turns one leaked credential into shared infrastructure for many downstream requests.
Supply chain and credential theft widen exposure
Unit 42 says attackers obtain AI access in several ways, including phishing, information stealers, exposed repositories, unsecured file shares and poisoned npm packages. The report says privileged corporate developer accounts can be used to create new API keys, remove billing limits, or disable usage alerts and logging.
The npm risk is especially significant because malicious packages can sit inside the software delivery chain. Unit 42 says poisoned, self-propagating npm packages can steal credentials and access tokens from development environments, then infect other code releases built by the developer. The report names Shai-Hulud and Miasma as concerning npm supply chain attacks and says credentials stolen through such campaigns could be used to fuel transfer stations for years.
The defensive lesson is narrow but important: secret management and software package governance are now part of AI cost control. A company can set careful model policies and still lose money if a build environment leaks the token that enforces them.
The bill can arrive before defenders see the abuse
The most immediate damage from token jacking is financial. Unit 42 says transfer stations can generate tens of millions of API calls per day, which can translate into hundreds of thousands of dollars in usage fees. The report also says Unit 42 responded to cases where attackers integrated inadvertently exposed credentials into a transfer station within minutes, leading to nearly a million dollars in charges before discovery and containment.
Recovery may be difficult. Unit 42 says organizations affected by token jacking have limited recourse to recover funds billed by AI services for use of their API tokens. Smaller businesses may be hit hardest because a sudden usage spike can disrupt budgets, and the bill may be legitimate from the provider’s perspective if requests were authenticated with a valid key.
There is also a data risk for people using transfer stations intentionally. Unit 42 warns that developers seeking low-cost AI access through these intermediaries may have prompts routed to inferior models or have sessions monitored and mined for sensitive information. Cheap access can therefore create future victims as well as immediate hidden costs.
Controls that reduce the blast radius
Unit 42 recommends spending limits, usage alerts and reviews of privileged accounts that can provision resources or adjust limits. These controls do not stop every compromise, but they can make abnormal consumption visible before a billing cycle produces a major surprise.
The report also recommends moving from long-term access keys to short-term bearer tokens where possible. Shorter-lived credentials reduce the time window in which a stolen secret remains useful. Unit 42 further recommends using an AI gateway with machine authentication so large language model traffic can be tied to a verified and managed machine identity, monitored in real time and checked for usage anomalies.
Network boundaries and development pipeline controls are also part of the response. Unit 42 says compute resources should use network restrictions where available so compromised keys cannot easily be used from transfer station infrastructure. It also advises tight management of development environments to keep malicious packages out of the pipeline.
Conclusion
Token jacking shows how AI adoption has expanded the value of ordinary developer secrets. A stolen API key can now buy access to expensive model capacity, feed a proxy marketplace and leave the legitimate account holder with the charge.
The strongest takeaway from Unit 42’s report is operational rather than theoretical: AI credentials need budget guardrails, identity controls, short lifetimes and monitoring that treats abnormal model consumption as a security signal. Organizations that already manage cloud keys should extend the same discipline to AI keys before gray market demand makes a small leak expensive.
Sources
Editorial Team - CoinBotLab