AI Cybercrime Explodes: Stolen Keys Double in Price

Stolen AI credentials and API keys are appearing on Telegram marketplaces, complete with customer support and money-back guarantees. One vendor advertised access to Anthropic's models at a discount. Okta's threat intelligence team identified listings after analyzing a large data dump that exposed thousands of unexpired authentication tokens for major tech companies. These tokens can bypass multi-factor authentication entirely.

Machine credentials are now central to cyberattacks, powering mass exploitation campaigns that have breached hundreds of organizations globally. They were also targeted when API keys were stolen from numerous AI firms through a compromised evaluation sandbox. The underground market for these stolen AI accounts has seen prices more than double this year.

Autonomous AI agents have been documented launching large-scale attacks, exploiting vulnerabilities to breach organizations. These agents can scan targets, write their own exploits, and harvest credentials with minimal human oversight. One campaign saw agents achieve full domain administrator access within minutes at a high school.

API keys from dozens of AI companies were also stolen via a compromised evaluation sandbox. Separately, fraudulent resellers offered discounted AI access while silently harvesting user credentials. A Russian state actor reportedly used AI to automate malware rebuilding and evasion, targeting government and diplomatic organizations.

Concerns are rising as enterprise IAM policies are built for human users and often fail to distinguish or properly govern machine identities. Many organizations have not yet adopted specialized products for managing AI agent identities, leaving them vulnerable to credential theft and misuse. Experts emphasize the need to inventory which agents hold credentials and how they are managed.