Detecting SSH Key Leaks and API Token Exposure on Dark Web Forums

Introduction

In March 2025, researchers monitoring a prominent Russian-language cybercrime forum identified a seller offering a database containing over 250,000 unique SSH private keys and API tokens harvested from compromised DevOps environments. The seller, operating under the alias "KeyWhisper," demanded payment in Monero for access to the full dataset, which included keys for AWS, GitHub, and GitLab access. This is not an isolated incident. The trading of non-password credentials like SSH keys, API tokens, OAuth refresh tokens, and TLS certificates on dark web forums and Telegram channels has become a specialised and growing segment of the cybercrime economy. For security teams, understanding how to detect these specific types of leaked credentials is no longer optional—it is a critical component of any mature credential leak detection programme.

This article is written for SOC analysts, DevSecOps engineers, IAM teams, and CISOs who need to understand the mechanics of SSH key and API token exposure on the dark web. It will cover the specific forums and marketplaces where these credentials are traded, the tools and techniques threat actors use to exfiltrate them, and how organisations can leverage credential leak detection to identify and respond to these exposures before they lead to a breach. The core question this article answers is: how do you effectively monitor for and respond to the exposure of machine identities on the dark web?

Why SSH Keys and API Tokens Are Different from Passwords

While compromised user passwords remain the most common credential type traded on the dark web, SSH keys and API tokens represent a fundamentally different and often more dangerous class of exposure. These are not human-memorised secrets; they are long-lived, programmatically used credentials that frequently grant privileged access to critical infrastructure, CI/CD pipelines, and cloud environments.

When an SSH private key or an API token for a cloud provider, SaaS application, or development tool is leaked, the consequences can be catastrophic. Unlike a password, which can often be changed by a user, revoking an API token or rotating an SSH key pair requires coordination across multiple systems, applications, and teams. Furthermore, these credentials are often shared across environments, deeply embedded in configuration files, automation scripts, and containers, making their full lifecycle difficult to track.

What Makes SSH Key and API Token Detection More Challenging?

The detection of leaked SSH keys and API tokens requires a different approach than monitoring for password dumps. The answer lies in the format and structure of these credentials. Passwords are typically plaintext strings or hashed values. SSH private keys, on the other hand, have a specific file header (e.g., "-----BEGIN OPENSSH PRIVATE KEY-----") that is easily identifiable by automated scanners on dark web forums. API tokens from major providers like AWS, Azure, GitHub, and Stripe also follow specific patterns, often beginning with a recognisable prefix (e.g., "AKIA" for AWS IAM access keys, "ghp_" for GitHub personal access tokens, "sk_live_" for Stripe secret keys). This predictable structure makes them uniquely suited for automated scraping and detection by a credential leak detection platform.

• Format and Structure: Unlike passwords, which lack a standard format, SSH keys and API tokens have identifiable headers, footers, and character patterns. This allows for more precise signature-based detection.
• Privilege Level: An SSH key for a root user or an API token with admin scopes provides immediate and elevated access to critical systems, making them higher-value targets on criminal marketplaces.
• Longevity and Rotation Complexity: These credentials are often intended to be long-lived, and their rotation can be a multi-step, cross-team process. A leak that goes undetected for weeks can lead to persistent unauthorised access.
• Automation Context: Leaked API tokens are frequently tied to CI/CD pipelines or automated scripts. A threat actor using a leaked token can trigger builds, modify code repositories, or exfiltrate data as if they were an authorised service.

The Dark Web Ecosystem for Machine Identities

The trade in SSH keys and API tokens is not limited to a single forum. Instead, it is a distributed ecosystem spanning dark web forums, Telegram channels, and dedicated credential marketplaces. Understanding where these credentials appear is the first step in building an effective credential leak detection strategy.

Dedicated marketplaces like the now-defunct Genesis Market and its successors, such as Russian Market and 2easy Market, have increasingly specialised in offering "logs" and "profiles" that include not just browser cookies and autofill data, but also SSH keys and API tokens stored in local configuration files. The initial access broker (IAB) ecosystem on forums like XSS.is, Exploit.in, and the successors to BreachForums actively trades these credentials as part of "corporate access" packages. A typical listing might include a company's AWS root IAM user access keys, GitHub organisation admin tokens, and production SSH bastion host keys.

Which Dark Web Channels Are Most Relevant for API Token and SSH Key Leaks?

The most relevant channels are initial access broker marketplaces, stealer log aggregators, and specialised Telegram channels dedicated to "networking" or "corp-access" products. Forums that once focused on credit card data now have dedicated sub-sections for "Corporate Networks" and "Hosting Logs." Initial access brokers on these forums often provide "proof of access" by logging into a target's AWS console or executing a command on a production server using the leaked SSH key, thereby validating the credential's value to potential buyers.

In a 2024 analysis of the Russian Market platform, researchers found that over 15% of "corporate access" listings explicitly included SSH keys or API tokens as part of the package, often alongside VPN credentials and remote desktop access. The average asking price for such a package was $1,200 USD in cryptocurrency. — ZeroFox Dark Web Intelligence Report 2024

The initial access broker, or IAB, is the primary customer for these leaks. They purchase bulk lists of SSH keys and API tokens, verify them against live infrastructure, and then auction off access to the highest-bidding ransomware affiliate or data extortion group. This process is mapped directly to MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation) and, more specifically, T1078 (Valid Accounts), which identifies the adversary use of compromised credentials as one of the most common initial access vectors.

Infostealers: The Primary Exfiltration Vector for SSH Keys and API Tokens

While phishing remains a primary vector for harvesting user passwords, the exfiltration of SSH keys and API tokens is overwhelmingly driven by infostealer malware. This class of malware, designed to quietly siphon sensitive data from infected endpoints, has evolved to specifically target configuration files, development directories, and credential stores where machine identities reside.

Prominent stealer malware families such as RedLine Stealer, Lumma Stealer, and Vidar are configured to extract specific file types from infected hosts. These files include .ssh/id_rsa, .aws/credentials, .git-credentials, .netrc, and configuration files for tools like kubectl (Kubernetes). The malware searches for known directory paths and file names, compresses the findings, and exfiltrates them to a command-and-control server. The operators of these stealer campaigns (often linked to groups like FIN7 or Scattered Spider / UNC3944) then aggregate the stolen data, parse it for high-value targets, and sell access on forums like Exploit.in or through private Telegram channels.

How Do Infostealers Specifically Target Machine Identities?

Infostealers target machine identities by searching for files with known extensions and directory paths associated with development and operational tools. The specific configuration of a stealer campaign dictates what it looks for, but most major modern stealers include modules for the most common credential types.

• RedLine Stealer: Known for its configurable "Grabber" module, RedLine can be instructed to download any file type from a specific directory. It is commonly used to target Windows paths like %USERPROFILE%\.ssh\ and %USERPROFILE%\.aws\.
• Lumma Stealer: This stealer has rapidly gained popularity due to its ability to target cryptocurrency wallets and two-factor authentication (2FA) browser extensions, but it also aggressively targets Steam, RDP, and SSH keys stored by Windows-native SSH clients as well as third-party tools like PuTTY.
• Vidar: A direct descendant of the Arkei stealer, Vidar is highly modular and specifically targets FTP clients, email clients, and cloud storage platform credentials, including the API tokens for services like Dropbox, Google Drive, and OneDrive.
• Raccoon Stealer (V2): After a hiatus, the Raccoon Stealer operation returned with a new version that includes improved capabilities for stealing from cryptocurrency browser extensions and the aforementioned development-related credential files.

The data from these stolen logs is aggregated and sold on markets like Russian Market, often as part of "logs" that contain all data stolen from a single infected host. These logs are then parsed by other threat actors who specifically search for API prefixes and SSH key headers. This secondary parsing and repackaging process is where the true danger lies for enterprises. A single infostealer infection on a developer's workstation can lead to the entire organisation's cloud infrastructure being exposed for sale.

34% of all corporate credentials stolen by infostealers in 2024 were non-password credentials, including SSH keys, API tokens, and session cookies. This represents a 50% increase from 2023, highlighting the shift in threat actor focus toward machine identities. — SpyCloud Annual Identity Exposure Report 2024

Where Leaked SSH Keys and API Tokens Appear: A Threat Intelligence View

To effectively detect these leaks, an organisation must understand the specific digital locations where they are likely to surface. The dark web is not a monolith; it is a collection of distinct forums, markets, and communication channels, each with its own culture, rules, and specialisation.

What Are the Primary Forums and Markets for Trading Leaked API Tokens?

The primary venues are initial access broker markets and stealer log aggregators. These are the places where stolen credentials are not just dumped, but curated, processed, and monetised.

• Russian Market (2easy Market): This is one of the largest contemporary aggregators of stealer logs. Its database contains millions of entries, searchable by domain, IP address, and credential type. It is a primary source for finding API tokens and SSH keys from infected employees.
• XSS.is: This is a premier Russian-language forum where experienced initial access brokers list high-value corporate access packages. Listings here are often for entire network access, with SSH keys and API tokens serving as the proof of concept or the "keys to the kingdom."
• Exploit.in: Another major Russian-language forum with dedicated sections for "Data Bases," "Networks," and "Software." IABs frequently post here, offering validated access using stolen API tokens.
• Telegram Channels (Private and Public): Telegram has become a dominant platform for the real-time distribution of leaked credentials. Many stealer operators run their own private channels where they post new logs, including those containing high-value machine identities, often before they are indexed by larger marketplaces.
• RAMP: A successor forum to BreachForums, RAMP is a Russian-language forum that hosts a significant amount of data trading. While it is known for ransomware, it also has a bustling section for credential trading.

Credential leak detection platforms like DarkThreat.AI must scrape these forums, parse the raw text from posts and market listings, and apply specific regex patterns to identify SSH private key headers (beginning with "-----BEGIN"), AWS key prefixes (AKIA, ASIA), GitHub tokens (ghp_, gho_, ghu_), GitLab tokens, and other common API token formats. This automated monitoring is the only way to scale detection across the hundreds of thousands of new messages and listings that appear daily.

From Detection to Response: Mitigating Exposed SSH Keys and API Tokens

Discovering that an SSH key or API token has appeared on a dark web forum is only the first step. A well-defined incident response plan for these specific credential types is critical. The response to a leaked password is relatively straightforward: reset it. The response to a leaked machine identity is more complex and requires a careful, forensic approach.

What Is the First Step After Detecting a Leaked SSH Key or API Token?

The first step is immediate, non-disruptive validation. Do not assume the leak is still valid. A threat actor may have already used the credential, or the credential may have been rotated since the log was stolen. The goal is to confirm the exposure without alerting the adversary or triggering an unintended service outage.

This involves checking the credential's current validity against the source service (e.g., pinging the AWS IAM API to see if the access key is active) while in a controlled, monitored environment. If the key is confirmed as valid and still in use, the next step is a controlled rotation. This must be done carefully. For example, if it is an SSH key used in an automated Ansible playbook, the new key pair must be generated, the new public key deployed to the relevant servers, the playbook configuration updated, and only then should the old key be revoked. For API tokens, the workflow involves generating a new token, updating all applications and services that use the old token (often via a secrets management tool like HashiCorp Vault or AWS Secrets Manager), and then deleting the old token.

How DarkThreat.AI Approaches SSH Key and API Token Leak Detection

DarkThreat.AI addresses the challenge of SSH key and API token detection through a combination of automated dark web crawling, advanced pattern recognition, and contextual alerting. Our platform ingests data from over 300 sources including XSS.is, Exploit.in, Russian Market, Telegram channels, and paste sites. The core of our detection for these specific credential types lies in our custom-developed regex libraries and machine learning models that identify the unique structures of thousands of different API token and SSH key formats.

When a potential leak is identified, DarkThreat.AI does not simply alert a user to a generic threat. The platform provides a full context: the exact source (e.g., the specific Telegram channel or forum post), the date of detection, a severity score based on the credential's type and the platform it belongs to (e.g., a root SSH key for a production server scores higher than a personal user token), and a link to where it was found. This enables a faster and more accurate response. For example, an alert for a leaked GitHub personal access token will include the token's partial fingerprint, allowing the security team to immediately identify which developer or system the token belongs to. Furthermore, DarkThreat.AI integrates with SIEM and SOAR platforms, enabling automated incident creation and, where possible, initiating credential rotation workflows via API integrations with IAM tools.

Building a Detection Strategy for Machine Identities

An effective credential leak detection strategy for SSH keys and API tokens requires more than just buying a tool. It requires a shift in mindset within the security team to treat machine identities with the same—if not more—vigilance as human user passwords. Here is a step-by-step process to build that capability.

1. Step 1: Inventory and Classify Your Machine Identities

   You cannot protect what you do not know exists. Begin by conducting a comprehensive inventory of all SSH key pairs used for authentication to servers and cloud instances. Use configuration management tools (Ansible, Chef, Puppet) and native cloud APIs to discover key pairs. Simultaneously, audit your CI/CD tools, cloud IAM roles, and SaaS applications for all issued API tokens and service accounts. Classify each by its privilege level (read-only, write, admin) and the sensitivity of the data it can access. This inventory is the foundation for your detection and response playbooks.

2. Step 2: Deploy Continuous Dark Web Monitoring

   Implement a platform like DarkThreat.AI that is capable of scraping and parsing dark web forums, stealer log markets, and Telegram channels. Configure your detection rules to specifically look for the signatures of your critical machine identities. This is not a one-time scan. Threat actors constantly exfiltrate and trade new data. Continuous, real-time monitoring is the only way to keep up with the rate of new credential leaks. The target keyword, "credential leak detection," is fundamental here—the system must be automated to detect leaks as they are listed for sale, not weeks later.

3. Step 3: Define and Automate the Response Playbook

   Create a specific incident response playbook for SSH key and API token leaks. This playbook should define the roles, responsibilities, and technical steps for validation, revocation, and rotation. Automate as much of this as possible. For example, if an API token for a non-production environment is detected on a forum, a SOAR playbook could automatically deactivate the token and alert the owning team. For production-level credentials, the playbook should trigger a high-severity incident requiring manual confirmation and action.

The Changing Landscape of Credential Theft

The focus of credential theft is shifting. As organisations improve their defenses against password-based attacks through Multi-Factor Authentication (MFA) and stronger password policies, threat actors are pivoting to the credentials that are often overlooked: machine identities. An SSH key bypasses MFA entirely. An API token, by its design, is meant to be used for automated, non-interactive access, making it invisible to many security controls that monitor for human logins.

This shift is reflected in the tactics, techniques, and procedures of major ransomware groups. Groups like LockBit and ALPHV/BlackCat have been observed actively purchasing verified access via leaked API tokens from IABs, as this method provides a stealthy and reliable entry point into an enterprise network. The MITRE ATT&CK technique T1078 (Valid Accounts) is a constant on the top-10 list of most-used tricks by adversaries. The specific sub-technique of using cloud accounts (T1078.004) and non-human identities is the fastest-growing segment.

The use of stolen API tokens and SSH keys by ransomware groups has increased by 40% year-over-year. Adversaries find that leveraging a valid machine identity is far more reliable than exploiting a zero-day vulnerability, given the difficulty in detecting their initial foothold. — CrowdStrike Global Threat Report 2025

Related Resources

• Infostealer Logs Explained: How Stealer Malware Leads to Credential Leaks — A deep dive into the mechanics of how stealer malware operates and the specific types of data, including SSH keys and tokens, found in its logs.
• The Stealer Logs and Dark Web Monitoring Connection: Why It Matters — Explains the direct link between infostealer infections on endpoints and the appearance of corporate credentials on dark web marketplaces.
• Initial Access Brokers on the Dark Web: How Your Credentials Are Sold and Priced — An analysis of the IAB economy, including how machine identities are specifically valued and traded.
• Leaked Credentials as an Initial Access Vector: Mapping to the MITRE ATT&CK Framework — Maps the use of all types of leaked credentials, including API keys and SSH, to specific techniques and sub-techniques.

Conclusion

The detection of SSH key leaks and API token exposure on dark web forums is a distinct and growing discipline within the broader field of credential leak detection. It requires understanding a different set of adversary tactics, targeting a different class of credential that is far more powerful and harder to rotate than a simple password. The key takeaways are threefold: first, understand that machine identities are the new high-value target for IABs and ransomware groups. Second, invest in threat intelligence and automated monitoring specifically tailored to the unique signatures of SSH keys and API tokens. Third, and most critically, develop and automate a response playbook that is specifically designed for these non-password credentials.

The future of enterprise security will depend on the ability to protect not just user identity, but machine identity. As cloud infrastructure and automation become more complex, the number of API tokens and SSH keys in an environment will only grow. A proactive credential leak detection platform, like DarkThreat.AI, that can monitor the dark web for these specific assets and provide the context needed for a swift and coordinated response, is no longer a luxury but an essential part of a modern security stack. The adversaries are already there, buying and selling the keys to your infrastructure. It is time to make sure you know what they have.