This week, security researchers revealed the scale of the data stolen during March’s attack on LiteLLM, a widely used gateway connecting applications to AI models. A 153GB archive contained 400,000+ files linked to nearly 2,500 organisations, including cloud credentials, GitHub tokens, Kubernetes secrets and keys for OpenAI and Anthropic.
Our previous analysis has explored how AI improves malware and helps attackers find vulnerabilities. This incident reveals another risk. AI access is now a valuable commodity, and an established international "token-jacking" market turns stolen credentials into cheap model usage.
That market is particularly visible in China. OpenAI and Anthropic do not officially provide services there. Chinese developers may need an overseas network connection, telephone number, payment card and billing address to use them. Anthropic also restricts companies controlled by organisations in unsupported countries and now requires identity checks from some users.
Chinese developers still want Claude, ChatGPT and their coding tools. Their practical solution is an AI transfer station, or relay station.
The user buys credit through Alipay or WeChat Pay, and points their agents at a new API link. The endpoint may offer hundreds of models through the same OpenAI-compatible interface. Chinese technology publications review these services, comparison sites rank their prices and availability, and developer communities exchange advice about which stations are reliable.
Behind that simple link sits a murky and exploitative supply chain.
Account merchants register or acquire AI accounts in bulk. SMS platforms provide overseas telephone numbers. Card merchants supply foreign payment credentials. Proxy networks make requests appear to originate in supported countries. Reverse engineers study provider software for authentication shortcuts, while station operators rotate accounts and adapt whenever abuse controls change.
Know your customer (KYC) checks have added another industry. Station operators use synthetic identity documents and deepfake tools to match a face to a forged identity. When automated deception fails, brokers recruit real people to complete verification with genuine documents and live selfies. Transfer station "agents" travel to countries in South East Asia, Africa, and Latin America to source people willing to pass these checks.
Iris scans from KYC merchants in Cambodia and Kenya have reportedly been offered on the biometric black market for less than $30. A face or identity supplied for one AI account can later be reused for financial accounts, employment fraud or deepfake impersonation. The person providing it may have no knowledge of the businesses eventually built upon their identity.
At the centre, transfer stations combine these accounts and credentials into pools. Some buy official capacity. Others share subscriptions, farm free credit, use fraudulent cards or reverse-engineer consumer services. Stolen API keys can be added to the same pool, such as those harvested in the LiteLLM attack.
The station can extract further yield in other ways. It can charge for access, silently substitute a cheaper model, and many retain prompts and responses. Coding-agent logs may contain repositories, engineering decisions, and more credentials to harvest. These records support fraud, commercial intelligence or black model training.
Anthropic says DeepSeek, Moonshot and MiniMax generated more than 16 million Claude exchanges through around 24,000 fraudulent accounts. Transfer stations allegedly mixed this activity with ordinary customer traffic, obscuring who was making each request and why.
Despite Chinese authorities warning against grey and black transfer stations, the practice remains surprisingly normal there. Technology publications discuss how to choose a reliable provider. Developers compare prices and uptime. Relay software is openly available on GitHub. A customer sees a convenient API, not the account farms, stolen credentials, payment fraud and biometric identities that may be supplying it.
Takeaways: Time to check your AI model usage dashboard for unexpected traffic, unfamiliar models or sudden spending outside normal hours... It's always a good idea to "rotate" any API key stored in source code, developer laptops or pipelines, or better still use a secrets manager. Remember to set hard daily spending caps and alerts rather than waiting for the monthly bill. And if you're developing with languages like Python and installing lots of useful libraries, it's critical to use package scanners and to "pin" your package versions. This gives you control over upgrades and prevents potentially exploited packages such as LiteLLM getting installed silently. And whatever you do, stick to well known AI suppliers and never, ever use a transfer station!