Hackers Are Draining AI Accounts for Profit, Leaving Victims With Six-Figure Bills

A fast-growing cybercrime scheme is turning stolen AI credentials into a criminal payday, and the people footing the bill are often companies that never realized their access was compromised. Security researchers are calling it “AI token jacking,” and it’s quickly becoming one of the more expensive blind spots in enterprise cloud security.

At the center of the scheme are hackers who steal a single developer API key for a popular AI platform, then quietly funnel the victim’s paid compute capacity into a criminal resale pipeline. The victim keeps working as usual. Meanwhile, somewhere else, dozens or even thousands of strangers are running AI workloads that the victim’s company is unknowingly paying for.

The financial exposure can escalate in hours, not weeks. Palo Alto Networks’ Unit 42 threat intelligence team has tracked cases where a single exposed key was absorbed into a criminal resale operation within minutes and racked up close to a million dollars in charges before anyone caught it.

What “Token Jacking” Actually Means #

Tokens, Not Session Cookies

The word “token” here has nothing to do with a login session in a browser. In the world of large language models, a token is the metered unit of text that an AI system processes, whether it’s reading a prompt or generating a response. Every API call to a model provider burns through tokens, and every token has a price attached to it. That billing structure is exactly what hackers are exploiting.

Why API Keys Are Such a Tempting Target

Companies rely on API keys so that applications, scripts and AI agents can talk to model providers automatically, without a person logging in each time. That convenience is precisely what makes the keys so dangerous once they fall into the wrong hands. Whoever holds the key effectively holds the victim’s entire AI budget.

Unlike traditional cloud infrastructure, AI usage is notoriously hard to predict. A single automated workflow involving lengthy prompts, expanding context windows, chained tool calls or looping AI agents can consume enormous volumes of tokens in a short window. Providers are often built to scale usage automatically so legitimate automated systems aren’t interrupted. Hackers have figured out how to hide inside that same flexibility.

How the Resale Pipeline Works #

“Transfer Stations” Turn Stolen Access Into a Business

Rather than simply using a stolen key for their own purposes, hackers increasingly plug it into what researchers call “transfer stations,” black-market services that resell discounted access to leading AI models to paying customers. These operations frequently run on modified versions of open-source proxy software, including projects known as new-api and one-api, repurposed for illicit resale rather than their original legitimate use.

That software allows operators to rotate through multiple stolen credentials, reformat prompts to disguise their origin, route traffic across different AI models, manage customer billing on the back end, and mask where the compute is actually coming from. A customer buying access sees nothing but a cheap AI subscription. The company whose key was stolen sees a bill that doesn’t add up.

The Math Behind the Crime

The scheme only works at scale. According to Unit 42 researchers, transfer-station operators cannot buy premium AI access at full price and profitably resell it at a steep discount, so the entire business model depends on using stolen credentials rather than legitimately purchased ones. Once a valuable key is plugged in, Unit 42 says these operations can push through tens of millions of API calls a day, translating into hundreds of thousands of dollars in charges landing on the compromised organization’s account.

Where the Attacks Start #

Familiar Entry Points With a New Payoff

Hackers aren’t necessarily inventing new intrusion techniques to pull this off. Unit 42 points to well-established methods: infostealer malware, phishing campaigns, credentials left exposed in code repositories, unsecured file shares and compromised developer accounts. What’s changed is the target. Instead of chasing financial data or personal records, attackers are now hunting for AI credentials because the resale value is immediate and difficult to trace.

The Software Supply Chain Is Now a Front Door

Researchers specifically flag poisoned npm packages as a growing vector, since malicious code slipped into a widely used package can steal credentials directly from a developer’s environment and then spread automatically into every downstream project that depends on it. A single compromised package can multiply the damage across build systems and codebases far beyond the original target.

The Damage Goes Beyond the Bill #

A Stolen Key Can Become a Full Account Takeover

The financial fraud is often just the visible part of the problem. If the compromised account belongs to a privileged developer, an intruder may be able to generate new keys, unlock access to more expensive models, remove existing spending caps, silence billing alerts or scale back logging so the activity stays hidden longer. At that point, a single leaked secret has escalated into a broader identity compromise within the company’s cloud environment, with consequences that extend well past the original bill.

Buyers on the Other Side Face Risk, Too

The danger isn’t limited to the companies whose keys get stolen. Developers who knowingly or unknowingly buy cut-rate AI access through a transfer station may be sending proprietary prompts, source code, credentials or customer data through a proxy they don’t actually control. That traffic can be logged by the criminal operator, quietly downgraded to a weaker model, or mined for information that fuels further attacks.

How Organizations Can Protect Themselves #

Security researchers are urging companies to treat AI API keys with the same seriousness as any other high-value cloud credential rather than routine application configuration.

Recommended defensive steps include:

• Enforcing explicit spending limits on every AI API key
• Setting alerts that flag deviations from normal token-usage patterns
• Replacing long-lived static secrets with short-lived bearer tokens wherever the provider allows it
• Auditing which identities have permission to create new keys or change billing controls
• Applying network restrictions around AI resources and monitoring outbound LLM traffic continuously

Centralized tools such as AI gateways can also help by enforcing policy, authenticating workloads and flagging anomalous model traffic before it turns into a runaway bill. Palo Alto Networks, whose Unit 42 team investigated the activity, points customers toward its own Prisma AIRS AI Gateway, Idira Agentic Identity Security, Koi Agentic Endpoint Security, Cortex XDR, XSIAM and Advanced URL Filtering as relevant controls for this threat.

Indicators of Compromise #

Security teams reviewing logs for signs of this activity can reference the indicators Unit 42 has associated with known malicious API traffic.

IP addresses above are intentionally defanged to prevent accidental resolution or hyperlinking. They should only be re-fanged within controlled threat intelligence platforms such as MISP, VirusTotal or an organization’s SIEM.

Why This Story Isn’t Going Away #

As AI adoption accelerates across every industry, the number of API keys in circulation is only growing, and so is the incentive for hackers to target them. Unlike a stolen credit card number, a stolen AI key can be monetized almost instantly and at massive scale, which is exactly why researchers expect token jacking to keep showing up in incident reports throughout the year. Organizations that haven’t yet audited how their AI credentials are managed may want to treat this as a warning sign rather than a hypothetical risk.