The Thriving Black Market for AI Models

As demand for high-performance Frontier models rises and token costs increase, a lucrative black market has emerged for stolen AI accounts. In a recent report, Okta Threat Intelligence (OTI) warns of a massive surge in this type of cybercrime. Attackers are selling stolen AI accounts at discounts ranging from 70 to 90 percent off regular subscription prices. In one documented case, the bill for unauthorized AI use totaled nearly one million U.S. dollars.

Account Takeover via Infostealers and Token Hijacking

OTI identifies two primary attack patterns. The first involves taking over existing AI accounts using infostealer malware and token hijacking. In this scenario, attackers do not need traditional passwords: they steal session tokens and API keys directly from the victims’ browsers. By subsequently using these stolen session tokens via specialized anti-detection browsers and proxy networks, cybercriminals can completely bypass the login screen and multi-factor authentication (MFA).

The extent of this problem is illustrated by the analysis of a seven-gigabyte infostealer data dump from August 2, 2026. It contained logs from 5,871 infected computers in 162 countries and thousands of valid session tokens for major tech and AI providers such as Google, Microsoft, Anthropic, and Amazon. In addition, the attackers stole thousands of JSON Web Tokens (JWTs), nearly 18 percent of which contained unencrypted personal data—including names, phone numbers, and email addresses. This data provides an ideal starting point for future phishing and social engineering attacks.

Widespread Abuse of Startup Credits and Promotional Offers

In addition to directly stealing active accounts, cybercriminals fund their business models through the automated and abusive use of promotional offers. On the gray market, services such as «Poison Claude» or «Ecomagent.in» advertise unlimited tokens at a fraction of the official price. Behind the scenes, these providers hoard massive amounts of startup credits from cloud providers by using bot networks to register fake accounts on a large scale. To put this in context: Google offers up to $350,000 and Anthropic up to $100,000 in free credits for startups.

In another case, OTI recorded over 105,000 brute-force registration attempts at an AI video provider within a single month, originating from just 251 IP addresses. Since disposable email domains and popular Chinese email services were frequently used in these attacks, it is very likely that users in China are also using this method to bypass regional blocks on U.S. models such as ChatGPT, Claude, or Gemini.

Recommendations for Security Teams

To address this growing security risk, OTI recommends that affected security teams implement a series of targeted defensive measures. A key component is continuous session monitoring using specialized solutions that constantly scan sessions for contextual changes and trigger an alert if a token is reused. Ideally, this should be supplemented by universal logout functions to enable the immediate termination of compromised sessions across all applications.

In addition, API keys should be strictly limited and restricted through IP allowlisting, so that stolen tokens remain useless outside of known corporate networks. Finally, the effort required to create fake accounts must be significantly increased through the use of phishing-resistant credentials, such as passkeys. The key advantage of passkeys lies in their architecture: they cannot be stolen through credential farming, shared, or automatically generated in large quantities.

«This security research underscores our company-wide belief that the future of cybersecurity will consist largely of identity security, because the more AI models and AI agents are rolled out and deployed, the more important it becomes to manage access—both users» access rights to the models and those of the models themselves,” explains Arkadiusz Krowczynski, Principal Product Acceleration Specialist at Okta.

Source: www.okta.com