Stolen AI API tokens reach a reselling proxy within minutes — Unit 42 documents the 'transfer station' market and the account-takeover variant that mints its own keys
Unit 42 has put a name and a market structure to something most organisations still treat as a billing anomaly. "Token jacking" is the theft of AI-provider API tokens — through infostealer malware, phishing, credentials leaked in poisoned packages, or keys sitting in what Unit 42 calls improperly secured file shares or code repositories — and the monetisation path is a gray-market reseller layer Unit 42 calls a transfer station (Palo Alto Networks Unit 42, 2026-08-06). These services are typically built on openly available LLM-proxy software, which is doing something specific for the operator: it sits in front of the stolen legitimate token, obfuscates the real credential from the paying customer, handles authentication rotation and billing, and resells discounted access to the underlying model. The buyer never sees whose key they are spending, and the victim sees only usage.
The speed is what changes the response. "We’ve responded to cases where attackers stole inadvertently exposed credentials and integrated them into a transfer station within minutes" (Palo Alto Networks Unit 42, 2026-08-06), and in one such case "this led to nearly a million dollars in charges before discovery and containment" (Palo Alto Networks Unit 42, 2026-08-06). Unit 42 also documents a variant that does not depend on a single leaked key, and it is account takeover rather than a rogue employee: the privileged corporate developer accounts in question are harvested by infostealers or phishing, or bought from access brokers on dark-web marketplaces. An attacker holding one uses that account's own privileges to mint new API keys, provision additional models, remove billing limits, and disable usage alerts and logging — extending the abuse window by dismantling the controls that would have ended it. The financial exposure is largely one-way: "Organizations impacted by token jacking have very little recourse to recover funds billed by the AI services for using their API tokens" (Palo Alto Networks Unit 42, 2026-08-06).
We’ve responded to cases where attackers stole inadvertently exposed credentials and integrated them into a transfer station within minutes.
This led to nearly a million dollars in charges before discovery and containment.
Organizations impacted by token jacking have very little recourse to recover funds billed by the AI services for using their API tokens.
Defender actions
- Set hard spend ceilings on AI-provider accounts that the consuming credential cannot itself raise, and scope each API token to the minimum model and quota it needs — the account-takeover variant in this report works by removing billing limits and disabling usage alerts with the same account that spends the budget.
- Treat an AI API token found in a code repository or an unsecured file share as a same-shift rotation, not a backlog ticket: Unit 42 observed resale inside minutes of exposure.
ATT&CK mapping
8 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1098.001Account Manipulation: Additional Cloud Credentials
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1098.001Account Manipulation: Additional Cloud Credentials
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Defense Impairment TA0112
T1685.002Disable or Modify Tools: Disable or Modify Cloud Log
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
Credential Access TA0006
T1528Steal Application Access Token
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1552.004Unsecured Credentials: Private Keys
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Command and Control TA0011
T1090.003Proxy: Multi-hop Proxy
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Impact TA0040
T1496.004Resource Hijacking: Cloud Service Hijacking
Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.