Discounted Claude access bought on the gray market may expose every prompt you send

Okta discovered multiple underground services offering discounted or “unlimited” access to AI models by abusing free credits and fraudulent account registrations; researchers found exposed API routes revealing user counts, evidence of mass automated signup attempts (over 105,000 brute-force attempts observed), and operational techniques like gateway proxying that expose prompts and data to service operators. The report highlights specific indicators (poison-claude.bitsender.top, claudeopus.shop, a "msg_vrtx" API signature), use of cryptocurrency payments, Cloudflare CDN obfuscation, and likely China-based users leveraging VPNs and bots to circumvent regional restrictions, warning of privacy risks and service instability as providers tighten fraud controls.