Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations — Threadlinqs Intelligence
As of 2026-08-06, Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1911 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Token jacking is a criminal economy in which attackers steal AI API keys and tokens from legitimate developers — via phishing and infostealer-harvested privileged accounts, dark-web access brokers,
Token jacking is described by Unit 42 (Palo Alto Networks) as 'a new AI-oriented spin on an old technique of stealing access to computing resources.' The offense is the theft of API keys and bearer tokens that grant programmatic access to frontier AI platforms, enabling attackers to consume AI compute capacity while the legitimate account owner is billed. Because AI billing is token-based and many providers do not cap token consumption per account, billing occurs cyclically and victims often discover the theft only after massive consumption has already accrued. Unit 42 documents cases that accumulated 'hundreds of thousands of dollars' in usage fees, and 'nearly a million dollars in charges before discovery and containment' in at least one case, with the cost able to derail budgets or force smaller businesses into bankruptcy.
Token acquisition spans multiple vectors. (1) Account compromise: attackers compromise privileged corporate developer accounts harvested through infostealer malware and phishing campaigns, then use those accounts to create new API keys, provision models, remove billing limits, and disable usage alerts and logging. Such compromised accounts are 'readily available for sale by access brokers on dark web marketplaces.' (2) Direct key harvesting: attackers mine already-provisioned access keys from improperly secured file shares and code repositories. (3) Supply-chain compromise: poisoned, self-propagating npm packages (Shai-Hulud and its Miasma variant) are downloaded by developers; once installed they infect other code the developer builds and steal credentials and access tokens from each environment, amplifying impact. The infostealer pipeline is established: in March 2026 alone, one stealer-log service indexed 3.27 billion lines of compromised credentials, with Telegram now accounting for 68% of infostealer-log distribution; logs are sold to initial access brokers who enrich and resell them at premium.
Stolen tokens feed 'transfer stations' — fly-by-night gray-market vendors selling AI computing capacity at a fraction of retail cost. Advertised on Chinese-language marketplaces such as Taobao, they 'promise access to multiple AI services with seller-issued custom credits that are purchased anonymously.' Nearly every such relay runs on one of two open-source, OpenAI-compatible gateways — new-api (QuantumNous/new-api) and one-api (songquanpeng/one-api) — which handle obfuscation, rotation and authentication of real credentials, billing, model routing, and prompt normalization. The abuse is in the inventory, not the software: channels are stocked with stolen, leaked, or pooled credentials. An independent investigation (Matt Lenhard, Vectoral) mapped the resulting four-layer economy: upstream card/account merchants, midstream account pools that aggregate dozens to hundreds of accounts and manage auth tokens and rate limits, downstream relays/transfer stations that wrap the pool in a billed product, and end users including developers, startups, and commercial model-distillation buyers. The ten highest-traffic relays tracked pull a combined 3.6 million visits per month; the cheapest, 01Now Coding, offers a 97.8% discount off official pricing (for example $3,333 of official Anthropic credit sold for ~425 RMB). Unit 42 observed exposed credentials integrated into a transfer station 'within minutes.'
Token sourcing methods identified in the underground include free-trial abuse (mass automated account creation to claim free credits), chargeback attacks (reversing charges after usage, or starting with stolen cards), prepaid-card exploitation, open-inference abuse (proxying traffic through unprotected support chatbots or exposed /api/chat endpoints), and 'denial of wallet' attacks (flooding concurrent requests purely to burn a provider's spend). Beyond pure billing fraud, relays pose a data-exfiltration risk: prompts, code context, and multi-turn reasoning traces passing through a gateway are 'pre-labeled' training d
Weaknesses (CWE)
CWE-522, CWE-798, CWE-200
Target sectors: technology, software-development, cloud, ai, finance
Target regions: Global, Asia, North America, Europe
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195.001, T1195.002, T1195.003, T1078.004, T1204.002, T1059.007, T1098, T1053.005, T1562, T1027
