This campaign involves fraudulent registrations to exploit free trials and startup credits on AI service platforms, enabling discounted reselling of AI model access. Operators use automated bots, VPNs, disposable email domains, and residential proxies to create fake accounts on cloud platforms such as AWS Bedrock and Google Cloud. These accounts are then monetized by reselling access through custom API gateways, with discounts ranging from 70-90%. The campaign targets AI video services with over 105,000 brute-force signup attempts documented. Payment is accepted in cryptocurrency, and the services are promoted on underground forums and messaging platforms, particularly in Chinese-language markets. This activity constitutes a form of platform abuse rather than a software vulnerability and poses operational and financial risks to AI service providers.

The fraudulent account creation and resale of AI service access lead to significant platform abuse, financial losses due to misuse of free trials and startup credits, and potential degradation of service quality for legitimate users. The use of bots and proxies complicates detection and mitigation efforts. The campaign also undermines trust in AI service platforms and may affect regional access policies due to abuse originating from specific countries.

No official patch or fix applies as this is a platform abuse campaign rather than a software vulnerability. AI service providers should enhance fraud detection mechanisms, including monitoring for high volumes of signup attempts, use of disposable email domains, VPNs, and residential proxies. Implementing stricter identity verification and limiting the abuse of free trials and startup credits can reduce impact. Providers should also monitor underground forums and threat intelligence sources for emerging tactics and indicators such as the identified domains. Collaboration with payment processors to detect suspicious cryptocurrency transactions may help disrupt these operations.