Cybercriminals are increasingly targeting AI API tokens through poisoned npm packages, turning ordinary developer environments into credential-harvesting machines.
The stolen tokens can be abused directly or fed into underground “transfer stations” that resell discounted access to expensive AI models.
AI token jacking is becoming a costly risk as companies rapidly adopt large language models, automated agents, and AI-powered development tools.
Attackers do not need to break into an AI provider. Instead, they steal the API keys that legitimate developers and applications use to access those services.
These keys allow automated systems to make requests without requiring an interactive login every time.
Since AI providers commonly bill customers based on the number of input and output tokens consumed, a stolen key can quickly generate enormous costs.
In some cases, victims may not notice the abuse until the next billing cycle, after attackers have already made millions of API calls.
Poisoned npm Token Theft
npm supply chain attacks create a particularly dangerous path for token theft. Attackers publish malicious packages or compromise trusted packages that developers install in their projects.
Once executed, the code can scan local systems, configuration files, repositories, CI/CD pipelines, and cloud environments for credentials.
The threat becomes more serious when malicious packages are self-propagating. A compromised developer may unknowingly include the poisoned dependency in a new application or software release.
Every build created from that environment can then carry the malicious code into another developer workstation, build server, or production pipeline.
This allows attackers to steal credentials from multiple environments instead of a single machine.
API keys for major AI platforms, cloud services, source-code repositories, and other development tools may all be exposed during the process.
Unit 42 warned that attackers are using this activity to collect AI tokens at scale. Campaigns involving npm supply chain threats such as Shai-Hulud and Miasma could provide criminals with a large pool of valid credentials.
These credentials can remain useful long after the initial compromise if organizations fail to rotate them. Stolen AI tokens have immediate value because access to frontier AI models is expensive.
Attackers can use the keys for their own operations, sell them to access brokers, or route them through proxy services known as transfer stations, unit42 said.
Indicators of Compromise
| Indicator | Type | Context |
|---|---|---|
Go-http-client/2.0,gzip(gfe) | User-Agent | Associated with malicious AI API calls |
3.235.109[.]125 | IP address | Malicious API calls |
116.105.166[.]148 | IP address | Malicious API calls |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
