Hackers aren’t just stealing data anymore, they’re stealing your AI access

Hackers are no longer solely focused on stealing data; they are now targeting AI access. By obtaining stolen AI credentials, attackers gain the ability to utilize computing resources that their victims have already paid for. This shift in strategy has given rise to a criminal economy centered around the trade of AI access.

Attackers target API keys, session tokens, and other credentials that provide access to AI services. These stolen credentials can be resold, used in further attacks, or employed to run AI workloads at the victim's expense. The three primary benefits gained from stolen AI credentials are loot, compute, and cover. Reselling stolen AI credentials generates revenue, using someone else's computing power reduces the attacker's costs, and the activity can be disguised as legitimate customer behavior.

CrowdStrike's 2026 Threat Hunting Report highlights a similar trend, with one campaign generating nearly 200,000 API requests within a two-minute period. Criminals are abusing corporate AI access to generate fraudulent requests, utilizing the victim's computing resources instead of stealing information.

The economic value of this stolen AI access is evident, as API keys and session tokens are increasingly viewed as high-value digital assets. Once considered means to access networks and data, these credentials have now become commodities that can be directly monetized or abused.

The shift in focus from data theft to access theft reflects a natural evolution in cybercrime. Underground markets have progressed from selling VPN and RDP access to cloud credentials and now to AI platform access. Stolen AI accounts often come with an established payment method, usage history, and access to expensive models, making them attractive targets for criminals.

Furthermore, activity carried out using a legitimate customer's account can be more challenging to detect, as it appears to be legitimate usage. This provides criminals with an additional layer of cover, making it harder to flag their malicious activities.

In summary, hackers are increasingly targeting AI access rather than just data. By stealing API keys, session tokens, and other credentials, attackers gain access to computing resources that their victims have already paid for, creating a profitable criminal enterprise built around stealing AI access.