Threat Research Center Threat Research Malware Malware Token Jacking: Cybercriminals Could Be Stealing Your AI Resources 8 min read Related Products Advanced URL Filtering Cloud-Delivered Security Services Code to Cloud Platform Cortex Cortex Cloud Cortex XDR Cortex XSIAM Prisma AIRS Unit 42 AI Security Assessment Unit 42 Incident Response By: Unit 42 Published: August 6, 2026 Categories: Malware Threat Research Tags: AI API AI gateway API keys Npm packages Obfuscation Token jacking Transfer stations Share Executive Summary It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token jacking cases resulting in staggering financial losses. The financial loss comes from criminals gaining access to API keys used by legitimate developers for access to popular AI platforms. These keys are known as tokens, and their theft is called token hijacking, or token jacking for short. The unrelenting frenzy of AI adoption and soaring costs of model access are converging into an irresistible opportunity for cybercriminals. Premium pricing on scarce AI processing power means stolen access via tokens can generate a quick and easy profit for attackers. Complex, patchwork billing management and limitless scaling by default can lead to massive financial losses in short periods. Good security hygiene, combined with cutting-edge native AI protection tools, can prevent losses before they begin. Palo Alto Networks customers are better protected through the following products and services: Prisma AIRS AI Gateway Idira Agentic Identity Security Koi Agentic Endpoint Security Cortex XDR and XSIAM Cortex Cloud Identity Security Advanced URL Filtering The Unit 42 AI Security Assessment can help empower safe AI use and development. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team . Related Unit 42 Topics AI , LLM , Supply Chain How Tokens Work Token jacking is a new AI-oriented spin on an old technique of stealing access to computing resources. Establishing a session in service-based computing typically requires authentication, usually involving a username and password, and sometimes a secondary verification method. Many services allow an authenticated user to then generate keys that programs can use on a user's behalf to establish sessions without going through an interactive login to support automated processes. Within a session, the service provider and user have agreed on a structured way to pay to use their service to achieve a pre-defined objective. AI — in particular, large language models (LLMs) — typically does not have pre-defined objectives. Users can and do carry on long conversations of widely varying complexity, which can consume enormous amounts of the provider’s computing resources. Automated processes also use LLMs to produce iterative content, which they then further process and return to the LLM with additional, related prompts. To best support this freeform usage, providers typically break both the input prompt and the output data into small chunks called tokens. Regardless of the objective, billing is then based on how many of these tokens are consumed during the session. Newer and more complex AI models charge more per token, ostensibly because more resources are required to deliver the output. To avoid interruptions in unpredictable workstreams, many providers do not limit the number of tokens an account can consume, instead tallying usage and billing on a cycle. If an attacker can steal one of these keys, they may find themselves with unlimited programmatic access to tokens that they can then use themselves or resell to other users. Since billing occurs cyclically, the victim might not even be aware of the theft until the attacker has consumed a massive number of tokens. Transfer Stations To better understand token jacking, we must understand transfer stations. Skyrocketing token costs for frontier AI models and regional usage restrictions have spawned a massive gray market of fly-by-night vendors selling AI computing capacity at a fraction of the retail cost. Figure 1 below shows an example of these advertisements. These services are commonly called transfer stations. Figure 1. Advertisement for gray-market frontier model access. Third parties acting as intermediaries between official AI providers and end users sell these transfer stations. Many of these advertisements appear on Chinese-language marketplaces like Taobao. They promise access to multiple AI services with seller-issued custom credits that are purchased anonymously. Earlier this year, a researcher named Harshal Singh posted a fascinating deep dive into this world . A large number of these transfer stations run on just a few open-source software platforms like new-api or one-api , which act as proxy services to official AI APIs. These proxy services handle: Obfuscation Rotation and authentication of real credentials Billing Model routing Normalization of prompts In many cases, users of these transfer station services are developers seeking inexpensive AI access. Other use cases are less benign. Competing nation-states can use these transfer stations' proxy services to access cutting-edge frontier models to train and refine their own models at a fraction of the cost that AI development normally incurs. Transfer stations require access to legitimate API tokens for the associated AI models. Attackers often steal or hijack these tokens from a variety of legitimate sources. How Transfer Stations Obtain Tokens For transfer stations to be cost-effective, their operators require access to a large pool of discounted legitimate tokens for each frontier AI model offered. Purchasing tokens at full price to simply resell them at a discount isn’t profitable, so many operators turn to stolen credentials. Attackers can use privileged corporate developer accounts they’ve harvested via information stealers or through phishing campaigns to perform the following activities: Creating new API keys Provisioning models Removing billing limits Disabling critical usage alerts and logging These developer accounts are readily available for sale by access brokers on dark web marketplaces. However, a more direct approach is to steal already provisioned access keys. Attackers can harvest these like they do credentials. They can also mine keys from improperly secured file shares or code repositories. More recently, attackers have stolen these keys using poisoned, self-propagating npm packages downloaded by unsuspecting developers. Once installed, these packages infect any other code releases the developer builds. They steal credentials and access tokens from each environment along the way, amplifying the impact. Particularly concerning are npm supply chain attacks like Shai-Hulud and Miasma. Attackers could use the huge number of credentials stolen in these campaigns to fuel transfer stations for years. Impact of Transfer Stations' Token Jacking The financial impact of token jacking can be catastrophic to organizations. Transfer stations can generate tens of millions of API calls per day, resulting in hundreds of thousands of dollars in usage fees. We’ve responded to cases where attackers stole inadvertently exposed credentials and integrated them into a transfer station within minutes. This led to nearly a million dollars in charges before discovery and containment. In some of these cases, we connected massive numbers of malicious API queries to domains hosting the new-api proxy service. Figure 2 shows an example of a transfer station frontend marketplace hosted on an IP address running an instance of new-api and connected to an attack. Figure 2. Webpage from a transfer station site with prices for different AI models. Organizations impacted by token jacking have very little recourse to recover funds billed by the AI services for using their API tokens. The cost can derail budgets or even force smaller businesses into bankruptcy. Even unsuspecting developers trying to use transfer stations for legitimate development risk having their prompts routed to inferior models. Furthermore, developers risk having their sessions monitored and mined for sensitive data that could turn them into future victims. Mitigation Organizations can protect themselves against token jacking through various methods. Implement spending limits for AI usage Ensure that these limits alert organizations if usage changes drastically from an established baseline Review all privileged accounts that can be used to provision resources or adjust spending limits Migrate from long-term access keys to short-term bearer tokens to limit the potential window of damage Use an AI gateway in combination with a machine authentication platform This can help ensure that all LLM traffic is tied to a verified and managed machine identity, allowing for real-time monitoring of traffic and usage anomalies Ensure that compute resources include network boundaries where available This restricts access to corporate infrastructure, preventing compromised keys from being used in a transfer station scenario Tightly manage development environments to ensure malicious packages do not enter the development pipeline Conclusion AI adoption is accelerating at an unprecedented pace. A mindset of “fail fast and break things” has never been more true — or more risky — than it is today. This mindset brings with it an opportunity for cybercriminals to target vulnerable organizations through token jacking and to cause staggering losses. While innovation cannot be at the mercy of security, there are ways defenders can manage their risk. Palo Alto Networks customers are better protected through the following products and services: Prisma AIRS AI Gateway The Prisma AIRS AI Gateway helps provide a central control plane to secure and govern enterprise AI traffic. By managing API keys centrally, it removes sensitive credentials from developer envir