Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
ID: c963da0c-d86b-55af-93c8-96a251c10f4d
STIX ID: report--c963da0c-d86b-55af-93c8-96a251c10f4d
Feed Name: Palo Alto Networks Unit 42
Threat Score
This Unit 42 report describes 'token jacking'—criminals stealing AI API keys to programmatically consume costly model tokens via gray‑market 'transfer stations'—outlining attacker techniques (credential theft, npm supply-chain packages, proxy services like new-api), real examples of rapid, large financial losses, associated IOCs (user-agent and IPs, domains), and recommended mitigations (spending limits, short‑lived tokens, AI gateways, CI/CD protections).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.