Stolen AI API tokens reach a reselling proxy within minutes, Unit 42 documents the 'transfer station' market and the account-takeover variant that mints its own keys

Unit 42 has put a name and a market structure to something most organisations still treat as a billing anomaly. "Token jacking" is the theft of AI-provider API tokens (through infostealer malware, phishing, credentials leaked in poisoned packages, or keys sitting in what Unit 42 calls improperly secured file shares or code repositories) and the monetisation path is a gray-market reseller layer Unit 42 calls a transfer station (Palo Alto Networks Unit 42, 2026-08-06). These services are typically built on openly available LLM-proxy software, which is doing something specific for the operator: it sits in front of the stolen legitimate token, obfuscates the real credential from the paying customer, handles authentication rotation and billing, and resells discounted access to the underlying model. The buyer never sees whose key they are spending, and the victim sees only usage.

The speed is what changes the response. "We’ve responded to cases where attackers stole inadvertently exposed credentials and integrated them into a transfer station within minutes" (Palo Alto Networks Unit 42, 2026-08-06), and in one such case "this led to nearly a million dollars in charges before discovery and containment" (Palo Alto Networks Unit 42, 2026-08-06). Unit 42 also documents a variant that does not depend on a single leaked key, and it is account takeover rather than a rogue employee: the privileged corporate developer accounts in question are harvested by infostealers or phishing, or bought from access brokers on dark-web marketplaces. An attacker holding one uses that account's own privileges to mint new API keys, provision additional models, remove billing limits, and disable usage alerts and logging, extending the abuse window by dismantling the controls that would have ended it. The financial exposure is largely one-way: "Organizations impacted by token jacking have very little recourse to recover funds billed by the AI services for using their API tokens" (Palo Alto Networks Unit 42, 2026-08-06).