Full Report
Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys. The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.
Analysis Summary
# Tool/Technique: Token Jacking
## Overview
Token Jacking is an emerging attack pattern where threat actors compromise environments to steal AI service API keys (such as OpenAI, Anthropic, or AWS Bedrock). Instead of typical data exfiltration or ransomware, the primary goal is to hijack the victim's paid AI quotas to power "gray market" AI transfer stations. These stations resell access to high-end LLMs at a discount, shifting the financial burden of API consumption to the victim.
## Technical Details
- **Type:** Technique / Campaign Pattern
- **Platform:** Cloud Environments (AWS, Azure, GCP), Containerized Environments (Docker, Kubernetes), and Developer Workstations.
- **Capabilities:** Credential harvesting, API validation, automated proxying of AI requests, and monetization of stolen compute.
- **First Seen:** Observed increasingly in 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (e.g., Vulnerable Docker/Laravel instances)
- **[TA0006 - Credential Access]**
- [T1552 - Unsecured Credentials] (Searching for `.env` or config files containing API keys)
- [T1552.001 - Credentials In Files]
- **[TA0007 - Discovery]**
- [T1613 - Container and Resource Discovery]
- **[TA0009 - Collection]**
- [T1530 - Data from Cloud Storage Object]
- **[TA0011 - Command and Control]**
- [T1071.001 - Web Protocols] (Using compromised keys to proxy AI traffic)
- **[TA0040 - Impact]**
- [T1496 - Resource Hijacking] (Financial theft via API credit consumption)
## Functionality
### Core Capabilities
- **Credential Harvesting:** Automated scanning of environment variables, configuration files (e.g., `.bash_history`, `.env`), and cloud metadata services for strings matching AI provider patterns (e.g., `sk-proj-....`).
- **Key Validation:** Automated scripts that test stolen keys against provider endpoints (like `api.openai[.]com`) to verify validity and determine rate limits or credit balances.
- **Resource Hijacking:** Redirection of the victim's API quota to an attacker-controlled "Transfer Station" or "LLM Proxy."
### Advanced Features
- **Gray Market Distribution:** Integration with platforms like "One API," which allow attackers to aggregate multiple stolen keys into a single endpoint to sell "cheap" AI access to third parties.
- **Automated Scanning:** Use of specialized tools to find exposed `.git` directories or misconfigured Docker sockets to find secrets at scale.
## Indicators of Compromise
- **File Names:** `.env`, `config.py`, `credentials.json` (Targeted for access).
- **Network Indicators:**
- `api.openai[.]com` (High volume of unexpected traffic)
- `api.anthropic[.]com`
- `api.cohere[.]ai`
- `*.paloaltonetworks[.]com` (Security telemetry)
- **Behavioral Indicators:**
- Sudden spikes in API usage costs or rate-limit errors.
- Cloud instances executing `grep` or `find` commands searching for "KEY" or "SECRET" in `/etc` or `/home`.
- Unusual outbound requests to AI model endpoints from non-developer machines.
## Associated Threat Actors
- **General Cybercriminals:** Focused on financial gain through resource resale.
- **Oxy-Style Operations:** Groups specializing in "Proxy-jacking" and "Credential-jacking" for the purpose of reselling infrastructure.
## Detection Methods
- **Signature-based detection:** Monitoring for specific regex patterns of AI API keys in outbound web traffic or logs.
- **Behavioral detection:**
- Identifying anomalous API consumption patterns (e.g., a 24/7 steady stream of requests from a developer key usually used only during business hours).
- Detection of unauthorized access to `.env` or `.aws/credentials` files via EDR.
- **YARA/Scanning:** Scanning internal repositories and container images for hardcoded secrets using tools like TruffleHog or Gitleaks.
## Mitigation Strategies
- **Prevention measures:**
- Implement **Least Privilege**: Use scoped API keys with restricted permissions rather than administrative master keys.
- Use **Secrets Management**: Replace hardcoded keys/environment variables with solutions like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault.
- **Hardening recommendations:**
- Set **Usage Quotas**: Configure hard spend limits on AI provider dashboards to prevent runaway costs.
- **IP Whitelisting**: If the provider allows, restrict API key usage to known corporate IP ranges.
- **Regular Rotation**: Implement automated rotation of all AI service tokens.
## Related Tools/Techniques
- **Cryptojacking:** Similar resource theft, but targeting CPU/GPU for mining instead of API credits.
- **Proxy-jacking:** Hijacking bandwidth to sell as residential proxy services.
- **One API / New API:** Open-source tools frequently misused by attackers to manage and resell stolen AI keys.