--- title: "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources" url: https://daily.dev/posts/token-jacking-cybercriminals-could-be-stealing-your-ai-resources-os316gpzk source_url: https://unit42.paloaltonetworks.com/ai-token-jacking type: article source: "Unit 42" published: 2026-08-06T10:03:24.183Z updated: 2026-08-06T10:03:47.663Z tags: ["security", "cyber", "llm", "npm"] reading_time: 10 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Token Jacking: Cybercriminals Could Be Stealing Your AI Resources **[Unit 42](https://daily.dev/sources/unit42)** · 10 min read · 1 upvotes · 0 comments ## Summary Cybercriminals are stealing AI API keys (tokens) from developers and organizations to fuel gray-market 'transfer stations' — proxy services that resell AI compute capacity at steep discounts. Attackers harvest keys via info-stealers, phishing, exposed code repositories, and poisoned npm supply chain packages. Once stolen, keys are integrated into transfer station platforms (often running open-source proxies like new-api or one-api) within minutes, generating hundreds of thousands to nearly a million dollars in API charges before victims notice. Mitigations include spending limits with anomaly alerts, short-lived bearer tokens instead of long-term keys, AI gateways, network boundaries for compute resources, and tight control of development package pipelines. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [An Inside Look at the Relay Market Powering Token Resellers and Fraud](https://daily.dev/posts/an-inside-look-at-the-relay-market-powering-token-resellers-and-fraud-njahgl92o) · Hacker News · 2 upvotes · 0 comments - [The Dark Side of $1 AI: Inside the Underground Market for Pirated AI Access](https://daily.dev/posts/the-dark-side-of-1-ai-inside-the-underground-market-for-pirated-ai-access-bskrrdm2s) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#llm](https://daily.dev/tags/llm), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/token-jacking-cybercriminals-could-be-stealing-your-ai-resources-os316gpzk)