Criminal Hackers Add GenAI Credentials to Underground Markets

Cybercriminals are now able to purchase Generative AI (GenAI) account credentials on underground hacker markets along with other various illegal goods, according to new research.

The GenAI credentials include those that belong to users of ChatGPT, Quillbot, Notion, Huggingface, and Replit, among many others. eSentire's cybersecurity research team found that the hackers are selling the credentials for roughly 400 GenAI accounts per day, usually stolen from corporate end users' computers after they've been infected with an infostealer.

LLM Paradise was one underground service found to be selling stolen GenAI credentials, advertising GPT-4/Clause API keys at a starting price of $15 each (the market has since closed its doors). The threat actors also have leveraged legitimate outlets, at one point advertising the illegal products on social media platform TikTok.

Ultimately, the researchers also found that the threat actors are finding a variety of ways to monetize GenAI account credentials, whether that's by creating phishing campaigns or launching malware from the accounts, producing chatbots, or stealing sensitive corporate data such as financial information or customer information.

The researchers recommend that organizations monitor employee usage of cloud-based GenAI offerings, encourage GenAI vendors to implement WebAuth in their portals, use passkey security or password best practices, and use Dark Web monitoring services.