Hackers stole AI credentials to get $740,000 in free compute; Railway picked up the bill

Publisher excerpt From CSO Online

As AI model training and distillation increase, AI tokens are becoming a piping hot currency for threat actors. Cloud hosting provider Railway found out the hard way; it has confirmed a near 26-hour battle against attackers targeting AI provider credentials to sell to AI ‘transfer stations’ for use in model distillation. The crooks generated about $740,000 in fraudulent AI usage charges using the stolen credentials and potentially had access to up to 100,000 workspace credentials. Railway said the attacker’s database searches looked for AI provider keys by name before anything else; some queries also targeted cloud, database, and payment service credentials. The company disclosed the incident on October 22, and posted a follow-up report this week. Because of the ongoing investigation, it is not able to share the specific details and scale of the exploits, but advised users to revoke and reapply sensitive environmental variables stored on Railway prior to October 21. “AI credentials are becoming the new credit card numbers,” said David Shipley of Beauceron Security. “So-called LLMjacking is expected to displace Cryptojacking as a cheap, scalable way to make money.” A 26-hour battle The attack began on October 20, when hackers exploited a previously unknown vulnerability in Railway’s build infrastructure. They were able to evade filesystem isolation protections and obtain an internal credential that they used to access stored build histories. From there, they retrieved a copy of Railway’s internal source code and analyzed it to identify additional avenues of compromise. They then exploited another vulnerability involving an improperly configured trust relationship that allowed them to gain even more access to Railway’s infrastructure and obtain credentials used to decrypt customer environment variables. In a nearly 26-hour battle, Railway’s engineering team worked 24-7 in shifts and the escalating situation became a “contest of agent speed,” the company explained. The threat actor chained various exploits, moved laterally across multiple systems, and “probed many potential routes, in parallel.” Defenders in turn hardened routes in parallel. “This was not a single breach followed by a single fix,” Railway wrote. The threat actors were “fully evicted” on October 21, but over the course of their time in the system, they obtained and decrypted a “subset” of customer variables, roughly 100,000, or “at most” 1.85% of workspaces. They also racked up $740,000 in fraudulent AI usage charges, with customers reporting their keys answered coding questions and performed training-data tasks they never ran. The company is working to reimburse customers, including for charges providers decline to refund. The breach also exposed linked-account tokens belonging to more than 1,850 users, which included GitHub and OAuth tokens that Railway says it reset. The company worked quickly with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and ot…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.