Token Jacking: Cybercriminals Steal AI API Keys for Gray Market Resale

Executive Summary

A growing wave of token jacking — the theft of AI API keys — is enabling cybercriminals to resell access to frontier AI models on gray-market transfer stations, leading to staggering financial losses for legitimate developers. Palo Alto Networks' Unit 42 has responded to multiple incidents where attackers harvested API keys from corporate developer accounts and sold the stolen access at a fraction of retail cost, often through Chinese-language marketplaces like Taobao. The convergence of soaring AI model costs and unlimited token consumption by default creates an irresistible profit opportunity for attackers, who can drain accounts before victims notice the billing spike.

Technical Analysis

Token jacking is a modern twist on an old technique: stealing access to computing resources. In service-based computing, users authenticate with credentials and often generate API keys for automated processes. For AI services, especially large language models (LLMs), usage is billed per token — chunks of input and output data. Newer models charge more per token, and many providers do not limit token consumption to avoid interrupting unpredictable workloads, instead tallying usage and billing cyclically. If an attacker steals an API key, they gain unlimited programmatic access to tokens, which they can use themselves or resell.

Unit 42 explains that the gray market for AI access has spawned "transfer stations" — fly-by-night vendors selling AI computing capacity at a fraction of retail cost. These services act as intermediaries between official AI providers and end users, often running on open-source proxy platforms like new-api or one-api. These proxies handle obfuscation, rotation and authentication of real credentials, billing, model routing, and normalization of prompts. Users include developers seeking cheap AI access, but also nation-states that use these proxies to access frontier models for training their own AI at reduced cost.

To be cost-effective, transfer station operators need a large pool of discounted legitimate tokens. Purchasing tokens at full price to resell at a discount isn't profitable, so many turn to stolen credentials. Attackers harvest API keys via information stealers or phishing campaigns targeting privileged corporate developer accounts. Once obtained, these keys are fed into the proxy infrastructure, which rotates them to avoid detection and billing anomalies.

Unit 42 notes that the financial loss is often not discovered until the attacker has consumed a massive number of tokens, due to the cyclical billing model. The report highlights that good security hygiene, combined with native AI protection tools, can prevent losses before they begin. However, the report does not disclose specific victim names or financial figures.

Mitigations & Recommendations

Defenders should monitor AI API usage for anomalies, such as sudden spikes in token consumption or access from unusual geographic regions. Implement strict key rotation policies and use gateway solutions that enforce rate limits and anomaly detection. For organizations using AI services, consider isolating API keys with least-privilege access and integrating with identity security tools to detect compromised credentials. Unit 42 recommends using AI-specific security products like Prisma AIRS AI Gateway and conducting regular security assessments to identify exposure.