Stolen AI Credentials Fuel Growing LLM Proxy Economy

Malicious actors have been exploiting the use of proxy servers to conceal their identity when accessing frontier AI models, a practice that has become increasingly prevalent in recent months. According to a report from security firm Team Cymru, more than 80,000 such proxies have been identified, with many using stolen AI credentials obtained through information stealers, phishing campaigns, and supply-chain attacks.

The use of proxy servers, also known as transfer stations, allows malicious actors to hide the origin of traffic to frontier models, making it difficult for providers to detect and prevent model distillation attacks. This type of attack involves targeted prompts designed to extract model knowledge that can be used to train and improve other AI models.

Team Cymru researchers initially identified 10,867 proxy servers running two open-source relay platforms called Claude Relay Service (CRS) and its successor, sub2api. Further investigation revealed a total of over 80,000 such proxies, with many using pools of API keys or logged-in consumer subscriptions to connect to upstream AI services.

These transfer services authenticate customers with their own accounts but use stolen credentials to access the AI models. This allows malicious actors to bypass the terms and conditions set by frontier model providers, enabling fraud and illicit activity.

Team Cymru’s investigation tied several clusters of activity through these proxies to IP addresses in China and Hong Kong. The researchers noted that over half of the transfer gateways are hosted on VPS services in the US, suggesting an intent to hide the geographic location of traffic. This could be used for model distillation attacks or other malicious activities.

The NSA, CISA, and FBI published an advisory earlier this month accusing six China-based AI companies of engaging in industrial-scale distillation of US models through transfer stations and fraudulent account pools. However, distillation is not the only use for these services. Researchers from Palo Alto Networks warned about the increasing number of AI token-jacking cases, where stolen API tokens and subscription credentials are abused via transfer stations.

An investigation by Okta Threat Intelligence found 561 Anthropic session tokens collected from 5,871 infected machines, including 164 that had not expired when the dataset was released. Additionally, researchers identified 24 valid API keys for Gemini, OpenAI, Groq, and OpenRouter, along with underground tools designed to find AI-service sessions in stolen browser data.

Researchers from Gambit Security observed a Chinese-speaking threat actor validating 2,975 credentials collected from 1,742 hosts and uploading working keys to an AI API-reselling gateway. The collection included 448 Gemini keys, 254 OpenAI keys, 176 Anthropic keys, as well as credentials for Groq, OpenRouter, xAI, and Amazon Web Services.

The sub2api project has been forked more than 8,000 times and its Telegram channel has almost 7,000 subscribers. Its GitHub page lists 26 commercial sponsors, including API relay resellers, residential proxy vendors, AI account providers, a content delivery network optimized for relay traffic, and a media-generation API service.

Team Cymru analyzed a cluster of servers hosted by several US virtual private server providers and found more than 4,000 IP addresses in China and Hong Kong connecting to 304 transfer stations. During eight days in late August, those addresses sent approximately 14TB to the relays and received over 7TB.

The researchers noted that traffic toward Chinese AI services was lower-volume and download-heavy, while traffic toward Western providers such as Anthropic, OpenAI, Google, and xAI was upload-heavy. Seventeen relays proxying traffic to Anthropic’s API uploaded approximately 81GB while receiving around 1.4GB.

Team Cymru estimated the uploaded data could represent between 16 billion and 23 billion input tokens if it consisted of text-based context. However, without access to the prompts or responses, they were unable to confirm what the sessions were about.

Inference endpoints are live production attack surfaces,