Cybercriminals are intensifying their focus on AI assets, specifically targeting credentials, cloud environments, and sensitive research data. This trend is not just about theft; it's a strategic approach to operationalize their own AI capabilities, as highlighted in a recent report from security experts at Team Cymru.
On their radar are proxy servers, referred to as transfer stations, that allow these actors to obscure the source of their traffic directed at advanced AI models. This tactic facilitates model distillation and further exploitation of stolen subscription credentials.
Originally, Team Cymru documented an alarming 10,867 servers utilizing two specific open-source relay platforms: Claude Relay Service (CRS) and sub2api. After further investigation, this figure ballooned to over 80,000 proxies. As Scott Fisher, a senior principal engineer at Team Cymru, puts it, “A transfer station undermines every frontier-model control by breaking the assumption that the requestor is the one consuming the answer.” This ecosystem is crafted to violate the terms and conditions set by frontier model providers, paving the way for fraud.
These proxies authenticate users with their own accounts while using pooled API keys or subscriptions that are often obtained through nefarious means—highly organized credential theft being the prime suspect.
Geographic Obfuscation and Its Implications
Analysis from Team Cymru indicates a troubling link between proxy activity and IP addresses traced back to China and Hong Kong. Over half of these transfer gateways are hosted on US-based VPS services, suggesting a deliberate attempt to conceal traffic sources. This could enable sophisticated model distillation attacks, where prompts are crafted to extract knowledge from AI models for use in training other, potentially illicit models.
Every major AI lab has reported facing distillation attacks, a problem that has attracted the attention of intelligence agencies like the NSA, CISA, and FBI. Earlier this month, these agencies issued a warning claiming that six China-based AI companies are systematically engaging in the distillation of US AI models through the exploitation of these transfer stations.
Escalating Abuse: Token Jacking and Credential Harvesting
Yet, model distillation isn’t the only concern. In August, researchers from Palo Alto Networks highlighted a spike in AI token-jacking incidents. These breaches are executed via transfer stations and lead to financial damages amounting to hundreds of thousands of dollars. High-level developer account credentials are systematically harvested using phishing schemes, infostealers, and supply-chain attacks, particularly from npm packages.
An investigation by Okta Threat Intelligence found an extensive cache of credentials, revealing 561 Anthropic session tokens harvested from over 5,800 infected devices. A significant number of those tokens were still active at the time of discovery. This intrusion also exposed 24 valid API keys across popular services like Gemini, OpenAI, Groq, and OpenRouter, alongside tools designed for mining AI service sessions from compromised browser data.
Similarly, Gambit Security has identified a Chinese-speaking cybercriminal actively validating nearly 3,000 stolen credentials sourced from more than 1,700 hosts, which were subsequently uploaded to an AI API resale platform. The trove included multiple credentials for prominent services, indicating a thriving and organized black market.
A Commercial Relay Ecosystem
Team Cymru’s findings reveal that the two most prevalent relay packages in their initial probe were CSR and sub2api. Developed by a programmer named Wei-Shaw, sub2api offers features such as user management, billing on a per-user basis, subscription-to-API conversions, and even prompt auditing. With over 8,000 forks and nearly 7,000 subscribers on its Telegram channel, sub2api stands out as a focal point for these suspicious activities.
Moreover, its GitHub profile lists 26 commercial sponsors, including various API relay resellers and proxy service providers, illustrating the commercial success of these illicit operations. Furthermore, new API and one-api platforms were identified running amongst these transfer stations, and advertisements for such services are becoming increasingly common on Chinese-language marketplaces like Taobao.
Insights into Geographical Patterns
The connection between China and the growing transfer station activity is unmistakable. Team Cymru tracked a network of over 4,000 IP addresses in China and Hong Kong, which linked to 304 relay stations. Over a span of just eight days, this cluster transmitted approximately 14TB of data to the relays while receiving over 7TB back.
Interestingly, the observed traffic patterns indicated heavier uploads and less download activity to Western AI services like Anthropic and OpenAI, compared to the reverse with Chinese services. One striking example involved 17 relays associated with Anthropic’s API, which uploaded around 81GB relative to only 1.4GB received. This skew suggests potential automated querying aimed at model distillation, based on preliminary data extrapolations.
Joe Brinkley, head of offensive security at Cobalt, expresses the gravity of the situation, noting that “Inference endpoints are live, production attack surfaces… Providers need to protect their models with behavioral telemetry, sybil defenses, and output controls rather than relying solely on policy.” This highlights a growing consensus on the need for proactive defense measures.
Strategies for Safeguarding AI Credentials
Organizations must place equal emphasis on securing AI credentials as they would any other critical production secrets. One essential strategy includes replacing long-lived keys with short-term credentials whenever possible. Establishing spending limits on API accounts alongside monitoring alerts for abnormal request volumes and unusual activity patterns is also advisable.
Regular scanning of repositories, containers, application packages, and configuration files is crucial to identify any exposed AI credentials. Long-lived keys should ideally be kept outside of agent sandboxes, while temporary tokens should be utilized within workflows, only being injected when necessary.
Furthermore, incident response protocols should include guidelines for the swift revocation and rotation of compromised credentials and session tokens associated with any breached AI subscriptions.
As cybercriminals become increasingly adept at exploiting AI systems, vigilance and proactive security measures will be paramount to protect intellectual property and sensitive information.
