Loading story…
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as AI token jacking. The activity has generated nearly $1 million in fraudulent charges before some victims detected the abuse, with malicious infrastructure in some cases driving tens of millions of API calls per day. Stolen credentials are being monetized directly and also funneled through gray-market "transfer stations" that resell access to legitimate AI services using compromised or discounted accounts.
The stolen keys are being obtained through phishing, infostealer malware, exposed file shares, public code repositories, and poisoned software packages, including self-propagating npm packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The reporting included indicators of compromise associated with malicious API calls and transfer-station infrastructure, including the user-agent string "Go-http-client/2.0,gzip(gfe)," domains such as amutes[.]com and abb1[.]life, and multiple IP addresses tied to credential theft or abuse.
The report highlighted poisoned, self-spreading npm packages as an especially concerning way attackers steal developer, cloud, and AI credentials. It said a malicious package can exfiltrate credentials from a developer environment and contaminate later software releases.
Unit 42 linked the activity to gray-market intermediary services called transfer stations that resell access to official AI platforms using stolen or discounted credentials. In incidents reviewed by the researchers, this infrastructure generated tens of millions of API calls per day and drove victim fees into the hundreds of thousands of dollars.
Unit 42 reported a growing pattern of "AI token jacking," in which attackers steal or expose AI API credentials and abuse victims' paid model access. The report said Palo Alto Networks had observed nearly $1 million in charges accrued before victims detected and contained the abuse.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated campaign on the JetBrains Marketplace used at least **15 malicious IDE plugins** masquerading as AI coding assistants to steal developers’ API keys for services including **OpenAI**, **DeepSeek**, and **SiliconFlow**. Researchers said the extensions appeared legitimate and functional, but silently exfiltrated credentials entered by users to attacker-controlled infrastructure, turning trusted development tools into a credential-harvesting channel. The plugins were reportedly installed about **70,000 times** and were active from at least **October 2025 through June 2026**. Investigators linked the operation to fake assistant-style extensions and said the actor may have monetized the theft by reselling stolen API access; some plugins allegedly included a paid tier that appeared to return API keys sourced from other victims, suggesting the campaign blended credential theft with a marketplace for illicit API access.
Aug 11, 2026
Researchers running a global honeypot network reported active scanning and exploitation of Internet-facing AI inference and agent services, including **Ollama**, **LiteLLM**, **OpenClaw**, and **LangServe**. Attackers first profiled exposed endpoints to identify available models and capabilities, then exploited recently disclosed **LiteLLM** flaws to gain remote code execution and steal environment variables and access tokens. Between March and May 2026, three separate operators were observed taking over exposed Ollama and LiteLLM instances and repurposing them for offensive activity, including use of **Strix**, **HexStrike**, and an **OpenAI Codex** agent configured to suppress safety refusals. The compromised AI infrastructure was then used as backend capacity for attacks against downstream victims, while the exposed services also served as a source of stolen credentials and tokens. Researchers said they blocked attempted attacks on live targets and privately notified affected parties, warning that unauthenticated AI endpoints are now being abused both for credential theft and as operational infrastructure for malicious campaigns.
Jul 6, 2026
A coordinated supply-chain campaign on the JetBrains Marketplace used at least 15 malicious IDE plugins, published under seven vendor accounts, to steal developers’ API keys for AI services including **OpenAI**, **DeepSeek**, and **SiliconFlow**. Aikido Security said the plugins were disguised as AI coding assistants, code-review tools, and Git utilities, appeared functional, and were boosted with fake five-star reviews. The malicious extensions were first published in October 2025 and continued appearing through June 10, 2026, with combined installs reported at nearly 70,000. Researchers found the plugins intercepted credentials entered by users and exfiltrated them in plaintext over unencrypted HTTP to a hardcoded server at `39.107.60[.]51`, typically when developers saved settings in their IDE. Independent analysis of the **DeepSeek AI Assist** plugin confirmed the credential-theft behavior was still present, and the plugin remained available on the marketplace at the time of reporting. Investigators also identified a paid-tier mechanism in which the server returned working API keys to paying users, raising concerns that credentials stolen from free users were being redistributed as part of the scheme.
Jun 29, 2026