Understanding the Proxy Economy in AI Credential Theft

In recent months, cybercriminals have shifted their focus to the realm of enterprise AI, targeting critical assets such as credentials and cloud environments to enhance their own illicit use of AI technologies. A new report from Team Cymru reveals an alarming increase in the establishment of proxy servers, termed transfer stations, that obscure the source of traffic directed at advanced AI models. This is raising significant concerns about model distillation attacks and the unauthorized exploitation of stolen subscription credentials.

Initially, Team Cymru’s research identified around 10,867 of these proxy servers, which utilize two notable open-source relay platforms: Claude Relay Service (CRS) and its successor, sub2api. Their findings have since expanded, revealing a staggering total that exceeds 80,000. The critical insight here is the function of these transfer stations, which undermine the core assumptions underpinning the security of frontier model accounts. According to Scott Fisher, a senior principal engineer at Team Cymru, “A transfer station breaks the assumption every frontier-model control depends on: that the account making a request belongs to the party consuming the answer.” This discovery highlights an entire ecosystem engineered to exploit weaknesses in the terms and conditions set forth by model providers, facilitating widespread fraud and malicious activity.

The mechanics behind these transfer services are equally concerning. They authenticate customers through their own accounts while connecting to upstream AI services via pools of API keys or consumer subscriptions, often obtained through nefarious activities such as credential theft. Team Cymru's analysis traced various clusters of proxy activity back to IP addresses in China and Hong Kong. Given that more than half of these transfer gateways are hosted on VPS services in the United States, it's clear there's an intent to obscure the geographical origin of this traffic, likely to facilitate model distillation attacks. These attacks involve carefully crafted prompts aimed at extracting the knowledge of AI models to enhance competing systems.

Reports from multiple frontier labs indicate a rise in distillation attacks. Just recently, the NSA, CISA, and FBI issued an advisory accusing six Chinese AI firms of engaging in distillation activities targeting U.S. models through these transfer services and fraudulent account pools. This isn’t the sole use of these proxies, however. Research by Palo Alto Networks has uncovered a marked uptick in AI token-jacking incidents — attacks leveraging stolen API tokens and subscription credentials via transfer stations, resulting in substantial financial losses for victims. Hackers typically acquire the credentials linked to enterprise developer accounts through phishing campaigns, supply-chain vulnerabilities, and malware.

In an in-depth investigation of infostealer data dumps, Okta Threat Intelligence discovered 561 session tokens for Anthropic harvested from nearly 6,000 compromised machines, including 164 that were still active when the data was analyzed. Moreover, 24 valid API keys for major AI services have been identified, accompanied by underground tools designed to locate AI service sessions within stolen browser data. This indicates a highly organized approach to harvesting valuable credentials.

A Commercial Relay Ecosystem

The Team Cymru report highlights the primary relay packages in their findings: CSR and sub2api, both developed by Wei-Shaw and published on GitHub. The latter has gained immense popularity, with over 8,000 forks and nearly 7,000 subscribers on its Telegram channel. Intriguingly, its GitHub page lists 26 commercial sponsors, encompassing various API relay resellers and vendors, including businesses dedicated specifically to generating AI-related content and control networks for relay traffic. This commercial backing points to a well-structured market around these illicit relay systems.

Meanwhile, other analyses by Palo Alto Networks uncovered transfer stations utilizing platforms such as new-api and one-api, indicating the expanding range of tools employed in these operations. Notably, advertisements for AI relay services have begun appearing on Chinese-language marketplaces, underlining the international scope of this issue.

China-Linked Traffic Patterns

When examining the proxy servers hosted by U.S. VPS providers, Team Cymru found over 4,000 IP addresses in China and Hong Kong interacting with 304 transfer stations. During a concentrated monitoring period, these addresses transmitted approximately 14TB of data to the relays while receiving around 7TB. The servers engaged with a mix of both Chinese and Western AI services, including prominent names like DeepSeek, Qwen, and ByteDance's Doubao, as well as industry leaders such as Anthropic and OpenAI. Observations indicated a distinct pattern where traffic towards Chinese services was predominantly download-heavy, while communications with Western providers leaned towards uploads.

Particularly revealing was the behavior of 17 relays connected to Anthropic's API, which uploaded roughly 81GB while only receiving about 1.4GB — a lopsided ratio of 58 to 1. Though researchers couldn’t directly assess the content of these interactions, this unusual traffic suggests the likelihood of automated queries designed for model distillation purposes.

As Joe Brinkley, head of offensive security at Cobalt, emphasizes, “Inference endpoints are live, production attack surfaces.” It's evident that AI providers need to develop defenses beyond mere policy compliance; they should focus on proactive measures utilizing behavioral telemetry and direct defenses against sybil attacks to safeguard their models effectively.

Strategies for Protecting AI Credentials

To fend off these evolving threats, organizations must elevate the security of their AI model credentials to match that of other sensitive production secrets. Best practices suggest replacing long-lived keys with short-lived credentials wherever feasible, and it’s essential to impose spending limits on API accounts alongside alerts for any anomalous activities. Privileged developer accounts must be subject to even stricter scrutiny due to their potential to create keys or modify billing limits.

Security teams should regularly audit their repositories, containers, and configuration files for exposed AI credentials. The aim should be to keep long-lived credentials out of easy reach of agent sandboxes, opting instead for temporary tokens generated on a need-only basis to meet requirements. Furthermore, incident response protocols need to include procedures for the immediate revocation and regeneration of AI credentials whenever potential compromises are identified, ensuring that any active session tokens linked to vulnerable subscriptions are rendered inactive.