Token Jacking: Cybercriminals Could Be Stealing Your AI Resources

    Wednesday, August 19, 2026 In: Threat Research Print

    Date: 08/19/2026

    Severity: High

    Summary

    Token jacking is an emerging AI-focused threat where cybercriminals steal developers’ AI API keys or tokens and use them to access AI platforms without authorization. Attackers can consume large amounts of expensive LLM processing resources or resell the stolen access, potentially causing significant financial losses before the victim notices. The risk is increased by high AI processing costs, scalable usage, and delayed billing, making strong API key protection and usage monitoring essential. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    amutes.com

    abb1.life

    IP Address

    3.235.109.125

    116.105.166.148

    172.96.142.186

    38.46.219.166

    38.46.219.163

    38.46.219.162

    23.237.196.170

    15.204.106.173

    104.243.42.117

    198.255.70.210

    47.88.103.81

    47.251.72.239

    117.72.74.48

    207.246.106.162

    23.236.182.215

    95.214.112.26

    User Agent

    Go-http-client/2.0,gzip(gfe) 

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "amutes.com" or url like "amutes.com" or siteurl like "amutes.com" or domainname like "abb1.life" or url like "abb1.life" or siteurl like "abb1.life"

    Detection Query 2 :

    dstipaddress IN ("207.246.106.162","38.46.219.166","23.237.196.170","116.105.166.148","3.235.109.125","117.72.74.48","23.236.182.215","95.214.112.26","47.88.103.81","15.204.106.173","198.255.70.210","47.251.72.239","38.46.219.162","38.46.219.163","104.243.42.117","172.96.142.186") or srcipaddress IN ("207.246.106.162","38.46.219.166","23.237.196.170","116.105.166.148","3.235.109.125","117.72.74.48","23.236.182.215","95.214.112.26","47.88.103.81","15.204.106.173","198.255.70.210","47.251.72.239","38.46.219.162","38.46.219.163","104.243.42.117","172.96.142.186")

    Reference:    

    https://unit42.paloaltonetworks.com/ai-token-jacking/                                  


    Tags

    MalwareAIStealerLLMs

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.