Executive Summary
Unit 42 has observed a surge in 'token jacking,' where attackers steal API keys for frontier AI models (LLMs) to resell access via gray-market proxy services known as transfer stations. These stations, often running on open-source platforms like 'new-api' or 'one-api,' allow attackers and third parties to utilize expensive AI resources at the victim's expense, frequently targeting Chinese-language marketplaces like Taobao.
The attack chain involves harvesting developer credentials through information stealers, phishing, or poisoned npm packages such as the 'Shai-Hulud' and 'Miasma' campaigns. Once an API key is obtained, attackers integrate it into their infrastructure, often removing billing limits and disabling usage alerts to maximize consumption before detection.
This threat is particularly critical for organizations rapidly adopting AI, as the consumption-based billing model of LLMs can result in losses exceeding hundreds of thousands of dollars within minutes. Affected organizations have limited recourse for recovering funds billed by legitimate AI service providers due to authorized (though hijacked) token usage.