Cybercriminals are now able to purchase Generative AI (GenAI) account credentials on underground hacker markets along with other various illegal goods, according to new research.
The GenAI credentials include those that belong to users of ChatGPT, Quillbot, Notion, Huggingface, and Replit, among many others. Cybersecurity research teams say that the hackers are selling the credentials for roughly 400 GenAI accounts per day, usually stolen from corporate end users' computers after they've been infected with an infostealer.
See: https://redskyalliance.org/xindustry/chatgpt-review
LLM Paradise was one underground service found to be selling stolen GenAI credentials, advertising GPT-4/Clause API keys at a starting price of $15 each (the market has since closed its doors). The threat actors also have leveraged legitimate outlets, at one point advertising the illegal products on social media platform TikTok.[1]
Ultimately, the researchers also found that the threat actors are finding a variety of ways to monetize GenAI account credentials, whether that is by creating phishing campaigns or launching malware from the accounts, producing chatbots, or stealing sensitive corporate data such as financial information or customer information.
The researchers recommend that organizations monitor employee usage of cloud-based GenAI offerings, encourage GenAI vendors to implement WebAuth in their portals, use passkey security or password best practices, and use Dark Web monitoring services, such as RedXray available at:
https://www.redskyalliance.com/redxray
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC).
For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://www.darkreading.com/threat-intelligence/criminal-hackers-add-genai-credentials-to-underground-markets
Comments