Exposing the Proxy Economy: How Cybercriminals Are Misusing AI Credentials
Recent investigations reveal a troubling trend: cybercriminals are increasingly infiltrating enterprise AI infrastructures to exploit stolen credentials, cloud environments, and research initiatives. Reports suggest a sophisticated method whereby these malicious actors are concealing their access to advanced AI models through the use of proxy servers, specifically termed "transfer stations."
According to a recent analysis by Team Cymru, a cybersecurity firm, these transfer stations serve as covert channels, directing traffic to high-end AI models while disguising its origin. This technique aids in model distillation attacks and facilitates the abuse of compromised AI subscription accounts.
Team Cymru's initial findings identified over 10,800 such servers operating through open-source platforms known as Claude Relay Service (CRS) and sub2api. The scope of this investigation was later expanded, with estimates now suggesting a total exceeding 80,000 proxy servers.
Scott Fisher, a senior principal engineer at Team Cymru, noted, “A transfer station disrupts the fundamental premise that requests to frontier models come from legitimate users. What we have uncovered is a comprehensive ecosystem designed to violate terms and conditions set by model providers, enabling fraud and illicit operations.”
These transfer services leverage their own user accounts to authenticate customers, while concurrently tapping into pools of API keys or subscriptions obtained through nefarious means, including credential theft.
Geographic Obfuscation of Malicious Activities
Further insights from Team Cymru revealed that specific clusters of these proxies trace back to IP addresses located in China and Hong Kong, raising concerns about organized cybercrime. A striking aspect of their operation is that more than half of these gateways are hosted on virtual private servers within the United States, hinting at an intention to obscure the true origin of the traffic. This obfuscation could potentially facilitate model distillation attacks, where crafted prompts extract valuable knowledge from advanced models for further training or improvement.
Reports indicate that all leading AI laboratories have faced model distillation threats, receiving heightened attention this month when the NSA, CISA, and FBI issued an advisory implicating six AI firms based in China in extensive distillation of U.S.-developed models through these illicit channels.
Broader Implications: Abuses of API Credentials
Distillation isn't the sole advantage of these proxy services. Earlier this year, researchers from Palo Alto Networks issued warnings regarding the surge in AI token-jacking incidents, where stolen API credentials exploited via transfer stations resulted in significant financial losses amounting to hundreds of thousands of dollars.
The stolen credentials often originate from privileged developer accounts, targeted through phishing attacks, information stealers, or supply-chain infiltrations utilizing malicious npm packages. Notably, a dive into infostealer data dumps by Okta Threat Intelligence revealed the collection of 561 Anthropic session tokens from numerous infected machines, including 164 active session tokens at the time of the dataset's release. Additionally, the research exposed 24 valid API keys across platforms like Gemini, OpenAI, Groq, and OpenRouter, and uncovered underground tools tailored to identify AI-service sessions in compromised browser data.
Research conducted by Gambit Security has documented a Chinese-speaking threat actor involved in validating nearly 3,000 credentials obtained from 1,742 different systems and subsequently uploading functional keys to an AI API-reselling platform. The credentials collected spanned significant entities, inclusive of 448 keys for Gemini, 254 for OpenAI, and additional accounts across various AI services.
A Network of Commercial Relay Services
The two primary relay frameworks identified during Team Cymru's analysis were CRS and sub2api, both originated by a developer identified as Wei-Shaw. The evolution of sub2api has garnered substantial traction, becoming a fully-fledged platform featuring user management, dedicated billing options, and advanced monitoring capabilities for AI usage.
This platform has been notably popular, boasting over 8,000 forks on GitHub and attracting close to 7,000 subscribers on its associated Telegram channel. Additionally, its GitHub listing showcases 26 commercial sponsors, including relay service resellers and providers of related technologies.
Palo Alto Networks also discovered other proxy services utilizing platforms like new-api and one-api, with many postings advertising AI transfer stations on Chinese digital marketplaces such as Taobao.
Infrastructure and Traffic Patterns
Analyzing the infrastructure of these proxy servers, Team Cymru noted over 4,000 IP addresses from China and Hong Kong sending data to 304 different transfer stations. Over an eight-day period, these addresses transmitted approximately 14TB of data to the relays while downloading roughly 7TB, allowing for significant engagement with both local Chinese AI services and Western providers like Anthropic and OpenAI.
A remarkable observation was the data upload patterns, revealing that seventeen relays supporting Anthropic's API uploaded around 81GB of data while only receiving 1.4GB, creating a staggering upload-to-download ratio of 58 to 1. If this uploaded content was textual, Team Cymru estimated it could equate to between 16 billion and 23 billion input tokens.
Without access to the specific prompts or the results, Team Cymru couldn't confirm the exact nature of these sessions. Yet, the unusual upload patterns are strikingly consistent with automated processes geared towards model distillation.
As Joe Brinkley, head of offensive security at Cobalt, noted, “Inference endpoints represent active attack surfaces in production. Providers must implement strong defenses at the application level—using real behavioral telemetry, sybil defenses, and output controls—rather than relying solely on compliance and policy measures.”
Strategies for Securing AI Credentials
Organizations are urged to regard AI model credentials with the same importance as other production secrets. Employing short-lived credentials in place of long-duration keys can enhance security, along with establishing spending limits and setting up alerts for unusual account activities. Privileged developer accounts, which can initiate key creation or adjust billing parameters, warrant even more stringent oversight.
Security teams should make it standard practice to search their organization’s repositories, container files, and application packages for exposed AI credentials regularly. Whenever feasible, long-lived credentials should be kept out of sandboxed environments, and temporary tokens should be crafted for use within workflows when they are essential.
Incident response plans must include comprehensive playbooks that facilitate the prompt revocation and updating of AI credentials alongside the invalidation of any associated session tokens from compromised accounts. These proactive measures are essential in curtailing the growing risk posed by cybercriminals exploiting the AI credential landscape.
