AI access key theft surges in WorkOS Northflank Trigger.dev breaches
Original title: AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Hackers steal AI access tokens from developer platforms using frameworks like Artex to monetize stolen keys.
Multiple AI developer platforms including WorkOS Northflank and Trigger.dev were hit in the past month with hackers hunting AI access tokens. Attackers used compromised credentials and AI tools to speed intrusions. Stolen keys are monetized via LLM-jacking infrastructure.
- Linked to Chinese APT Storm-0940
- Used open source Artex framework
- Accessed customer secrets on Chainstack
- Shared identical unauthorized activity within 30 minutes
Impact: stolen AI access tokens for monetization
- 1.rotate AI access tokens
- 2.monitor for Artex usage
- 3.enable cloud-delivered protection
- Threat actors
- Storm-0940
- Organizations
- Cloud Security AllianceWiz
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | trigger.dev | he most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS. Across all incidents, the hackers |
From the original article
3 min read at securityweek.com
Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks. The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger. dev Disclose Hacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.