Someone Is Reselling Your AI Key and Billing You for It

The reseller sells discounted access to the world's leading AI models, and one page of its website does something unusual for a criminal storefront. It scores its own customers. Snapshots of the site Wiz researchers track as "Xingjiabi" show a page titled 蒸馏检测监控, "distillation behaviour detection," built to sort users into "high risk," "watch," and "normal."

Distillation trains a cheaper model on the outputs of a more capable one, and frontier AI companies suspend accounts caught doing it. Wiz reads the page as an attempt to avoid association with distillation, potentially because the activity gets accounts suspended. A reseller living on stolen access needs its supply to stay alive. The page suggests enough of its customers attempt distillation to justify a tool for spotting them.

Wiz tied Xingjiabi and a second reseller, "momo," to testing of stolen Amazon Bedrock keys during a month in which at least nine AI developer platforms disclosed breaches. Wiz could not definitively connect either reseller to the original intrusions, though one victim's own forensic report places a momo address inside its network. One of the stolen keys drove roughly 1.7 million Bedrock calls in about 13 hours.

A security vendor has framed the October wave as a runtime problem, a failure of visibility into inference servers and GPUs. The disclosures point elsewhere. The best-documented intrusions trace to credentials earlier cleanups left valid, and the keys they yielded fed a resale market whose infrastructure overlaps with an AI attack framework China-nexus espionage adversaries already use. I assess with moderate confidence part of the market serves the kind of distillation the US government attributed to China-based labs two months ago. No public evidence connects any October key to a specific lab.

A Month of Platform Breaches

Wiz counts nine AI developer platforms disclosing incidents in October 2026. Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank all reported intrusions between October 6 and October 30. By November 10, the list had grown to include Brev (NVIDIA), Trigger.dev, Chainstack, kernel.sh, Blacksmith, Tensorlake, and NEAR AI, with RunPod reported through social media. Zeabur, breached for the second time in two months, will shut down on December 31.

The common prize was the customer's AI provider key. Railway's preliminary report says environment variables in up to 1.85 percent of workspaces, about 100,000, were potentially compromised over an attack window of roughly 37 hours. OpenCode told the 1.4 percent of Console users with a linked provider to revoke their keys, The Hacker News reported. Northflank told customers to assume every environment variable was decrypted, and Trigger.dev confirmed theft of customer root API keys.

Some platforms lost more than keys. Fireworks AI's first incident, on October 9, began with stolen internal credentials and reached secrets used in evaluation jobs. Its November update disclosed a second intrusion on October 24, after a third-party cloud provider hosting its research machines was breached. The second intrusion reached customer account and billing records and, for a limited set of accounts, stored secrets, datasets, and incomplete model weights. Notion and Cursor are among the customers Fireworks says it is working with.

I have tracked this wave since its first disclosures. My November 9 intelligence brief examined Northflank, Railway, and Trigger.dev and assessed an AI API key as both an authentication credential and an authorization to consume a billable service, worth more than the system it was stolen from. The wider pattern now visible across sixteen platforms raises a harder question. Someone is buying what these intrusions produce, and the buyers matter more than any single breach.

Where the Intrusions Began

Stealthium, a company selling GPU and AI runtime monitoring, published a recap of the wave on November 10 arguing "the decisive compromise happened at runtime." The same recap concedes each initial access was "a different misconfiguration, bug or leak." The disclosures support the concession and undercut the thesis.

Eight platforms have named a root cause, and only NEAR AI's points to the inference runtime. Fireworks and Lightning AI cite credential access, and Zeabur traces its intrusion to long-lived admin credentials stored in plaintext. Railway says the attacker obtained credentials for its CI environment after potential privilege escalation in its build infrastructure. Warp points to a third-party vendor dependency, Tensorlake to "an upstream provider," and OpenCode to a legacy system.

The other eight have published no cause. Trigger.dev is withholding the attack vector to protect its investigation, and Northflank patched CVE-2026-98432 across its fleet during the response without naming it as the cause. Any account of how the wave began, including this one, rests on half the disclosures.

The entry points differ, and the objective does not. Wiz found no single vulnerability or dependency linking the attacks, but every public report describes adversaries hunting stored environment variables, with a focus on those granting AI access.

Railway, Northflank, and Trigger.dev all encrypted those secrets, and encryption stopped none of the three intrusions. Railway's attacker queried envelope-encrypted environment variables and decrypted a subset with the compromised credentials. Northflank recorded its first decryption of secrets in the early hours of October 30. Trigger.dev decrypts environment variables just in time for each run, so a stolen customer root API key exposed them. A platform running customer code has to keep the decryption path live, and an intruder holding the platform's own credentials inherits it.

Google's threat intelligence team sees the same failures from the provider's side. Its LLMjacking research names exposed or stolen cloud identity tokens, IAM credentials, service account keys, and GitHub personal access tokens as the most common entry point. One threat actor Google tracks as UNC6993 compromised a cloud instance through a misconfigured service account key, attempted to generate additional API keys, and ran up more than US$100,000 in charges. Another exploited CVE-2026-40217, a user ID rebind flaw in LiteLLM's key regeneration endpoint, to turn standard keys into full administrative credentials.

Two incidents fit the runtime framing well. NEAR AI disclosed on November 9 an SGLang remote code execution flaw giving an attacker code on a live inference server.

Black Lotus Labs documented PoeLLM, a cryptomining botnet exploiting exposed servers running LiteLLM, Ollama, and similar tools. Black Lotus counts more than 3,400 victim servers in its summary and almost 2,200 in its analysis, and it associates the malware with an Italian-speaking threat actor. Exposed runtime services are a real attack surface. The keys draining customer budgets mostly left through identity and supply chain failures, the same lesson SLIM SPIDER taught with cloud metadata credentials.

Cleanups Nobody Finished

Zeabur's preliminary report is the only complete forensic timeline of the wave, and it tells the story of a breach without an end. In late August, an attacker exploited a flaw in a customer's NextChat application and moved through poorly isolated internal systems into Zeabur's production database.

Zeabur rotated credentials afterward. The rotation missed a shared cluster admin token created in January 2024 with no expiry, written in plaintext to a private configuration repository, and usable from the public internet. Zeabur hypothesizes the repository leaked in August, though its GitHub records are still pending and the attacker addresses from the two breaches do not overlap.

On October 14, someone used those credentials, and for roughly 36 hours no alert fired. The attacker read 3,218,965 environment variable records and data on 321,810 accounts, signed in as root to 101 GCP servers, and attached copies of 16 customer disks to virtual machines it created inside Zeabur's own cloud project. A deploy key for a service decommissioned four months earlier still worked.

The response repeated the original failure in miniature. At 15:40 UTC on October 15, Zeabur created a new backup access key. The 16:00 backup captured it along with every other secret in the cluster, because the backups stored secrets in plaintext. At 20:30 the attacker used it. Keys rotated to evict the intruder flowed into the next backup, and the backup handed them back. Backups sharing a trust domain with the systems they protect fall together, the lesson Osaka Metropolitan University learned when ransomware took its backups along with roughly 500 servers.

The same pattern runs through the software supply chain feeding these platforms. In late February, an attacker extracted a privileged access token from the Trivy scanner's GitHub Actions environment. Aqua Security rotated credentials on March 1, and the rotation was "not fully comprehensive, allowing the threat actor to retain residual access via still-valid credentials."

A malicious Trivy release followed on March 19. LiteLLM's CI pipeline installed it unpinned, the scanner stole LiteLLM's publishing credentials, and on March 24 ALTERED SPIDER (aka TeamPCP) published backdoored LiteLLM 1.82.7 and 1.82.8. CrowdStrike tracks ALTERED SPIDER as an eCrime adversary running open-source supply chain compromises since March 2026.

The harvest kept growing. In late April, the Mini Shai-Hulud campaign, attributed to TeamPCP, pushed malicious versions of Lightning's PyPI package, and Ox Security counted more than 1,800 repositories holding stolen developer credentials. Lightning AI, citing credential access, joined the October victims, though no public evidence ties its intrusion to credentials stolen in April.

LiteLLM fell again on October 21. Microsoft reports attackers used stolen developer GitHub credentials to redirect version 1.107.0's release workflow to a lookalike repository, then used a second developer's credential to pass a production approval step. Microsoft has not attributed the October release, and nothing public connects it to ALTERED SPIDER.

Zeabur and Aqua each treated containment as finished before it was, and everyone downstream inherited the gap. A rotation missing one token, a backup capturing the new keys, an unpinned scanner, and a developer credential stolen in an earlier campaign all leave an adversary holding valid access its victim believes is gone.

The supply chain compromises of 2026 produced developer and CI credentials in bulk, and the October wave drew on a pool those earlier breaches filled. I assess with moderate confidence incomplete remediation of earlier compromises enabled part of the October wave, with Zeabur the clearest case.

One Adversary or Many

Zeabur's intruder came for AI access. Its logs show searches for API keys and private keys, especially for AI services, and bulk reads of 736 n8n workflow instances and 10 new-api and one-api gateways, open-source software built to pool keys and redistribute model access. Google found UNC6993 using new-api for exactly that purpose. In 602 of the 607 n8n instances Zeabur checked, the encryption key sat in an environment variable beside the credentials it protected.

Zeabur does not say who ran the gateways, and if any belonged to resellers, the intruder robbed another seller's inventory. The attacker also tried to call Amazon Bedrock with Zeabur's own AWS keys and failed. The SSH key it planted on 50 servers carried a comment ending in "@zeabur-pentest," a label an administrator could mistake for an authorized test.

Diverse entry points argue against a shared exploit, and they leave the question of a shared adversary open. An agent-driven intrusion tests each target for whatever weakness it presents, and the results would resemble the list of root causes. Fireworks, OpenCode, and Warp all reported indications of an agent swarm, the pattern I documented when hundreds of autonomous agents ran a Russian-speaking threat actor's campaign against PaperCut servers in 48 countries. Zeabur's indicators supply harder evidence.

Its attacker used 23.106.46.239 for cluster access, cloud API calls, and SSH sign-ins. Wiz ties the address to momo, whose reseller sites the address has hosted since 2025. On October 8, six days before the Zeabur intrusion, a subdomain on the same address served an "ARTEX" autonomous penetration testing console.

ARTEX is a Chinese-developed AI penetration testing framework, and I have followed it since it surfaced. When CrowdStrike tied it to a single, likely Chinese-speaking threat actor hitting South Korean banks, I assessed the campaign as eCrime rather than espionage and argued the framework's real effect was making each additional target cheaper to try. Weeks later I traced ARTEX into China-nexus espionage and concluded the next adversary only needs a copy.

This month an ARTEX agent escaped a researcher's sandbox and breached WorkOS with nobody directing it. CrowdStrike has seen VAPOR PANDA running it against more than 200 organizations since October 17.

ARTEX agents hunt the same prize as the October intruders. Microsoft watched them search public GitHub repositories for credentials including AI inference API keys, and it reports the agents "repeatedly demonstrated a focus on credentials that provide access to AI services."

Zeabur also lists 31.57.201.201 for root sign-ins to its GCP servers in early September, and Wiz saw the same address using multiple stolen Bedrock keys between October 18 and October 25. Speed points the same direction. In both Bedrock cases Wiz traced, the first unauthorized call came within 30 minutes of the reported credential access at the breached vendor, a single model request inside a one-minute sweep testing stolen keys across multiple organizations. Someone was validating keys almost as fast as they left the platforms.

The evidence against a single adversary is just as concrete. Zeabur itself warns its addresses may sit on shared proxies, and commercial proxy networks rent exits from address space as unlikely as the Executive Office of the President's. Zeabur also cannot confirm the September sign-ins belong to the October intrusion.

Hunt.io classified 1,303 addresses as ARTEX infrastructure, so a console proves the framework was present, not who ran it, and eCrime threat actors and espionage adversaries use ARTEX alike. Shared infrastructure is the kind of clue I warned in Attribution Is a Confidence Game can mislead as easily as it informs.

Fireworks' second intrusion came through a breached cloud provider and Tensorlake's through an upstream provider, and access left over from earlier compromises may explain several entry points without any October coordination.

I assess with moderate confidence the Zeabur intrusion ran at least partly through infrastructure the momo operation controls or shares, because the address hosted momo's own sites for months before the attack. I assess with moderate confidence the wider wave involves multiple eCrime threat actors drawn to the same market, and I hold at low confidence any claim one threat actor drove the intrusions across platforms.

Keys as Currency

An AI provider key is a bearer instrument. Whoever holds it can spend the account owner's budget on frontier models, and the provider sees a paying customer. Wiz traced two enterprise keys abused through Bedrock. One generated about 800,000 calls over roughly 30 hours, with about 90 percent succeeding. The other generated about 1.7 million calls in roughly 13 hours. Opus-class models dominated both, and the two cases alone likely ran past US$100,000 at list price.

The resale layer is visible. The momo operation runs llm-routing.com, advertising discounted frontier model access paid in USDT, and its earlier sites carried Chinese-language titles. The Xingjiabi name transliterates 性价比, a common Chinese term for value for money.

Both resellers' infrastructure tested the stolen Bedrock keys only after high-volume abuse from unrelated addresses had begun. Wiz reads the timing as evidence of an active resale market, and the Cloud Security Alliance reaches the same view. I assess with moderate confidence the keys were sold or shared while still in use. The intrusion was only the first transaction, the pattern I traced through the eCrime ecosystem's money layer.

Google describes the same market from the other direction. Illicit gateways it calls "LLM Mixers" proxy and resell unauthorized model access, with one storefront offering an "unlimited token plan" for about US$60 a month. A separate grey-market relay reconfigures OpenAI's Codex and Anthropic's Claude Code command-line tools to route traffic through third-party servers, serving customers mainly in mainland China. Individual organizations absorbed more than US$100,000 in fraudulent charges in a single day, and some reached US$1 million before revocation.

Railway offered the most revealing description of its adversary. Its report describes an external party believed to hold "abliterated models and substantial compute resources," meaning models with their safety refusals stripped out.

Such models are now a commodity. Abliteration.ai sells hosted access with no customer checks beyond logging a credit card, and NEAR AI opened its uncensored cyber security models to every NEAR AI Cloud account at the end of October. Stripping refusals can also degrade a model's knowledge, so an attacker holding uncensored models still needs frontier keys for the work its own models do poorly, or for resale.

Resold access also powers new intrusions. The threat actor behind the ARTEX intrusions at South Korean financial institutions ran Claude Code through proxy shims and, in part, the reseller xcai.pro rather than through Anthropic, according to Hunt.io's reconstruction of the exposed workbench. Whether xcai.pro ran on stolen keys is unknown.

The cycle needs no coordinator. Stolen keys stock resellers, resellers sell model access to whoever pays, and some buyers turn that access on new victims. I have documented those economics since September. A likely Chinese-speaking threat actor spent roughly US$25 per target running open-source agents against 119 online retailers, and an affiliate of The Gentlemen spent between US$0.40 and US$4 per victim on AI tokens. Stolen keys push the cost of model access toward zero for whoever holds them.

Distillation Through Someone Else's Account

On September 8, the NSA, CISA, and FBI accused six Chinese AI firms of "systematic extraction" of US frontier model capabilities. The firms named were DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The agencies described VPNs, obfuscated accounts, bulk subscriptions, and relay services marketed on Taobao and Xianyu, and they urged providers to correlate activity across model providers, cloud platforms, and API aggregators.

When the advisory landed, I argued in China Did Not Steal American AI, It Interrogated It the extraction would look like a very large number of normal conversations spread across providers, accounts, and proxies so no single company could see the whole operation. Stolen keys add the victims' own accounts to that spread.

Anthropic's September threat intelligence report describes disrupting distillation from seven China-based labs, naming Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax. Alibaba's campaign alone generated more than 151 million exchanges between May and July, peaking near 3 million a day from more than 3,500 fraudulent accounts. The labs reached Claude through proxy services, which Anthropic says "will often use stolen API credentials belonging to legitimate companies or individuals."

OpenCode appears in the same report. DeepSeek rerouted requests from users of third-party coding harnesses, including OpenCode, to Claude Opus, and Xiaomi replayed user coding sessions through the OpenClaw and OpenCode harnesses. Weeks later, OpenCode called its own October breach "related to a large-scale distillation attack," and CommandCode attributed its incident to an attempt at distillation. Neither company has explained the connection.

A stolen key belonging to a developer in Berlin or San Francisco would let a distiller in Hangzhou query a frontier model from an account the provider already trusts, past the regional bans and identity checks Anthropic and OpenAI apply to China-based access.

The stolen key solves two problems for a distiller at once. It defeats geographic restrictions, and it launders attribution, because the provider's abuse systems see a legitimate customer's traffic and the victim receives the bill. Provider defenses tuned to spot fake accounts and suspicious sign-ups see nothing unusual about a long-standing paying customer whose usage suddenly spikes. The victim becomes the cutout.

Collection Runs Both Ways

Every relay in this market sees what passes through it. Anthropic reports proxy operators "often save exchanges between users and US models without the knowledge or consent of those users," and labs buy those transcripts. Developers told Oxford China Policy Lab researcher Zilan Qian the discounted access is customer acquisition and the harvested logs are the real business, Tom's Hardware reported in May.

A developer buying cheap frontier access sends source code, repository context, and credentials to a reseller with no obligation to protect them. Prompts also reveal intentions and decisions in progress. When China-aligned TA419 phished AI policy experts, I assessed the goal as getting inside the decision loop, and a relay reading prompts sits inside it by default.

The flow runs the other way too. Anthropic found Chinese labs routing their own users' requests to Claude without those users' knowledge, and some of the users were sensitive. One user, whom Anthropic describes as likely affiliated with the People's Liberation Army, analyzed CCTV surveillance data on a single person through what the user believed was Moonshot's Kimi.

An engineer building an internal system for a major Chinese state-owned enterprise exposed internal code and live credentials. DeepSeek relayed requests from an IT operator handling data from a Russian government agency associated with its Ministry of Defense, exposing live credentials for a government database.

Anthropic does not say whether any of those requests traveled on a stolen key. The architecture allows it. A proxy running on a stolen credential bills the victim's account for whatever it relays, so a surveillance query from a PLA-linked user could be logged against a Western company's identity and saved by the relay carrying it. The key's owner becomes an unwitting intermediary in intelligence work it never sees, and an investigator reading provider logs would see the Western company's account as the origin.

Whoever operates the relay holds the strongest position in the chain. A single proxy can carry traffic from Chinese state-linked users, Western developers, and AI attack frameworks alike, collecting without breaking into anything. That ARTEX threat actor sent its operational prompts through a reseller, and if that reseller kept logs, it holds a record of the campaign investigators had to rebuild from an exposed server.

No public evidence shows an intelligence service running or tapping a reseller. I assess with low confidence one already does, because the position offers collection without intrusion and the market has little oversight.

Competing Explanations

Commodity LLMjacking

eCrime threat actors steal keys and resell access, the same business model as cryptojacking with a more valuable commodity. The resale sites, the USDT payments, the subscription pricing, and the cryptomining botnet all fit. Fireworks attributes its October 24 intrusion to what it calls a "Financially motivated 'LLMjacking' group". I assess with moderate confidence resale for profit is the primary driver of the key theft.

Supply for Distillation

Some portion of stolen keys reaches distillation buyers, either directly or through resellers serving them. The victims' own distillation claims, Anthropic's finding of stolen credentials behind the proxies labs used, and a reseller screening its customers for distillation all point this way. I assess with moderate confidence stolen keys from the October breaches serve distillation demand in part. I hold at low confidence any claim the platform breaches were tasked by a lab or a state, because no public evidence shows tasking.

Collection as the Objective

If collection drives part of the wave, the intrusions and the relays are two routes to the same product. Platform access exposes stored keys and, at NEAR AI, requests in flight, while resellers hold transcripts by design. The ARTEX overlap adds a channel from the resale market toward espionage tooling. I hold intelligence collection as an objective of the October intrusions at low confidence, because no public evidence shows an intruder reading prompts or a state directing the theft.

Victims Inflating the Threat

"Distillation," "agent swarm," and "industry-wide attack" are labels victims applied to their own breaches, with Andromeda calling its incident part of an industry-wide attack. These framings recast routine credential failures as sophisticated campaigns, and none of the companies using them has published the evidence behind them. The most precise disclosure of the wave came from Zeabur, a company winding down with little left to protect, and it uses none of those labels. The labels may be accurate. They also serve the victims, and they deserve skepticism until the evidence appears.

Beijing's Rejection and the Legal Gray Zone

China rejects the premise. Foreign ministry spokesperson Mao Ning called on Washington to stop making "unfounded accusations and smears" and credited China's AI progress to technological self-reliance, and China's commerce ministry called the allegations groundless. None of the named firms has answered the individual allegations publicly.

Distillation itself is a legitimate research technique, and whether learning from a model's outputs violates intellectual property law remains unsettled. Stolen credentials and fraudulent accounts are plainly abusive, and the contested conduct often breaches provider contracts, access restrictions, and payment rules. Credential theft, contract violation, competitive model building, and state-directed collection are four different things, and the word "distillation" too often carries all four.

Runtime Risk Still Deserves Attention

The runtime argument fails as an explanation for October and holds as a warning for what comes next. NEAR AI ran its confidential inference inside a trusted execution environment and conceded the enclave "does not protect against a vulnerability in the software running inside" it. The attacker never had to defeat the hardware protection. SGLang ran inside the trusted boundary, and SGLang was the way in.

Confidential computing is marketed to governments and regulated industries as protection for sensitive prompts. Brave's Leo assistant reportedly runs chats in a NEAR AI-operated enclave, and NEAR AI has not said whether the affected server handled any of them. An inference server sees what users ask, which makes it a collection point for anyone positioned inside it, and records never designed to reveal intelligence can expose it once someone joins the fields.

Model weights carry their own risk. Fireworks' second intrusion reached incomplete model weights for some customers, and Stealthium has demonstrated tampering with weights in GPU memory in its own research. No public evidence shows weights altered in any October incident. Code running inside training and inference processes could make such changes, and the LiteLLM payloads ran in every Python process on affected hosts. Weight integrity checks at save and load cost little and close a gap no attacker has yet been shown to use.

Stealthium says it will publish two NVIDIA driver vulnerabilities, NvRoot and ForgePtr, allowing an unprivileged user on a shared GPU host to gain root. A vendor timing disclosures to its sales pitch is not a reason to dismiss the research. Multi-tenant GPU hosts underpin the neo-clouds and sovereign AI infrastructure governments are now funding, and a reliable tenant escape on those hosts would matter far more than any stolen API key.

Defending the Key

Remediation counts only when it is finished. An organization recovering from a breach should inventory every credential the intruder could have reached, including those sitting in backups, build systems, and configuration repositories. It should rotate them in one coordinated pass, keep the replacements out of anything the intruder can still read, and confirm the old ones fail. Pinned dependencies and short-lived publishing credentials, the changes LiteLLM made after March, shrink what a compromised scanner can steal.

Organizations using AI developer platforms should treat every stored provider key as a payment card held by a third party and rotate it after each platform disclosure. Routing restrictions slow a thief without stopping one.

The key behind the 800,000 Bedrock calls allowed global cross-region inference profiles, which spread the load across regions with only about 6 percent throttled. The key behind the 1.7 million calls allowed only US profiles, and a reseller pool spent four hours failing against it before a checker found working model identifiers the next morning. The ensuing flood still produced more than a million successful calls. AWS documents an explicit deny on requests whose requested region is "unspecified," which blocks global routing outright.

My November 9 brief argued financial controls now belong in the security architecture, and October shows why. Spending alerts arrive too late for this tempo, because every abuse window in this wave ran longer than a daily billing cycle could catch. AWS updates the billing data behind its budgets at least once a day, and a budget stops spending only through an action the customer configures in advance, such as applying a deny policy.

Google made hard spend caps for AI services generally available on October 30, triggering within minutes on estimated costs. A cap set to what the workload actually needs limits a stolen key more than any alert.

The bill lands on the victim. Providers record a stolen key's calls as legitimate consumption, and Zeabur told customers it is "unable to pay for third-party service charges" its breach caused, offering help requesting waivers instead. Platforms holding customer keys hold a concentrated target, and Denmark's population register showed how trusted access becomes an extraction channel. Railway moved builders to single-tenant infrastructure after its breach. Platforms storing provider keys should encrypt them with customer-held keys where possible, or avoid storing them at all through delegated authorization.

Model providers carry the counter-intelligence burden. The NSA, CISA, and FBI asked them to correlate activity across providers, clouds, and aggregators. Stolen-key distillation evades per-account controls, so detection has to move toward behavior. Sudden volume from new addresses, quota enumeration, and tiny validation requests all signal a stolen key, as do query patterns characteristic of distillation regardless of whose account sends them. Providers share an interest in pooling those signals, because a key stolen from one platform drains every provider it can reach.

The October wave began in credentials earlier cleanups left behind, passed through resellers selling frontier access for USDT, and reached a market whose buyers range from developers chasing discounts to labs Washington accuses of copying American models. An attack framework used by China-nexus espionage adversaries sat on the same infrastructure.

Every link in the chain bills someone else. The platform loses its customers' secrets, the provider records legitimate consumption, the reseller keeps the prompts, and the developer pays. Xingjiabi built a page to score its customers for distillation risk because it understood its own business better than most of its victims understood theirs. A stolen key buys its holder a seat in the contest over frontier AI, and the developer whose name is on the account pays for the seat without ever learning who sat in it.

Analyst Annex

Evidence status as of November 11, 2026.

Intelligence Gaps

Entities

MITRE ATT&CK Mapping

Microsoft maps additional LiteLLM 1.107.0 procedures, including browser credential theft and host discovery, in its full matrix.

Indicators

Wiz could not link the resale indicators to the platform intrusions. They mark key testing and resale activity only, and several addresses sit on commercial networks serving unrelated customers.

Microsoft publishes the Windows variants and the seven compromised wheel hashes in its indicator table, which remains the authoritative source.

Related Activity

ALTERED SPIDER's March compromise of LiteLLM and its later Mini Shai-Hulud campaign, documented by LiteLLM and JFrog, was not observed in the October incidents, and no public evidence connects ALTERED SPIDER to LiteLLM 1.107.0 or to Lightning AI's October intrusion.

Google's LLMjacking investigations, published by the Google Threat Intelligence Group, describe intrusions not observed in the October incidents.

The Canto Incognito campaign, documented by Black Lotus Labs, was not observed in the October incidents and monetizes access through cryptomining rather than key resale.

ARTEX activity documented by CrowdStrike, Microsoft, and Hunt.io, and examined in my ARTEX analysis, was not observed in the October incidents, and the ARTEX console on momo's infrastructure does not establish who ran it.

MITRE ATLAS Mapping

These techniques describe the distillation activity attributed to China-based labs by the NSA, CISA, FBI, and Anthropic. None has been observed in the October platform breaches.