Stolen AI API keys are paying for hackers’ autonomous scans
Bitsight says criminals sell MONST3R-AI, which uses stolen AI API keys to fund autonomous scans.
Bitsight tracked underground forums from February through August 2026 and found a seller offering MONST3R-AI, an autonomous scanning panel that runs on stolen OpenAI, Anthropic, and Google API keys so the key owner is billed. The seller claimed 1,072 findings on 199 hosts, which Bitsight could not verify. AI-related posts rose 45%, jailbreak discussion about 75%, while ransomware mentions fell 49%. Separately, the Water Kurita-linked FakeGit campaign used roughly 7,600 fraudulent GitHub repositories, more than 800 posing as AI skills or MCP servers, to spread SmartLoader.
64