Stolen AI credentials fuel LLM proxy economy, 80K+ servers

Security firm Team Cymru reported that malicious actors use proxy servers called 'transfer stations' to hide traffic to frontier AI models, enabling model distillation attacks and abuse of stolen AI subscription credentials. It initially found 10,867 servers running Claude Relay Service and sub2api, with the total now estimated above 80,000; some activity traced to IPs in China and Hong Kong.