Hackers Allegedly Selling VirusTotal API Keys on the Dark Web

A seller allegedly offered a VirusTotal Enterprise API key for $350 in an October 7 Dark Web Informer post, but the claim remains unverified, with no evidence confirming whether the key is genuine, stolen, or active.

According to the post, the seller claims limits of 5,000 requests per day, 300,000 per hour, and one billion per month. The seller reportedly accepts payment in Bitcoin or Litecoin and offers escrow.

These details describe the seller’s advertisement, not confirmed capabilities. The original Dark Web Informer post is the source of the allegation.

The advertised limits deserve scrutiny. A daily allowance of 5,000 requests would prevent a buyer from using 300,000 requests within an hour if both limits applied to the same activity. The listing does not explain whether the figures refer to different services, separate quotas, or inaccurate claims.

VirusTotal’s official quota documentation describes API limits per minute, daily, and monthly. Users can check their allowances and consumption through their account’s API key page.

That makes account-level verification important: a screenshot or brief demonstration alone can’t establish ownership, ongoing access, or the full advertised allowance.

Hackers Selling VirusTotal API keys

The platform also separates public access from paid API features. Its public API allows 500 requests per day and four requests per minute. Premium allowances depend on the licensed service level. An “Enterprise” label in a sales post therefore cannot, by itself, prove which features a buyer would receive.

An API key lets software communicate with VirusTotal without someone manually submitting every request through its website. Security teams use this access to retrieve file reports, investigate suspicious domains, and add threat data to automated workflows. Cybersecurity News’ VirusTotal threat research guide explains how these queries support investigations at scale.

Technically, VirusTotal API requests authenticate through the x-apikey HTTP header. VirusTotal warns that a personal key carries the user’s privileges and must not be shared.

Unauthorized possession could therefore let another person make requests under the affected account, subject to its permissions and quotas. This is credential misuse, not necessarily a breach of VirusTotal itself.

Depending on the subscription, misuse could expose licensed research capabilities or consume allowances needed by legitimate analysts. VirusTotal documents separate quota treatment for some operations, so the actual impact would depend on the key’s access and the endpoints used. Possession alone does not prove unrestricted access to every service.

The supplied report does not identify the account owner, explain how the seller obtained the alleged key, or provide evidence of a wider compromise. Claims in social media replies about possible sources should not be treated as findings. A working demonstration would show access at that moment, not lawful ownership or lasting availability.

Organizations concerned about exposure should review API usage, investigate unexplained requests, and revoke exposed credentials. Cybersecurity News’ API key theft coverage highlights usage reviews and revocation as responses to stolen keys.

For now, this listing remains an allegation requiring independent verification, rather than evidence of a confirmed VirusTotal breach or validated enterprise access.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Hackers Allegedly Selling VirusTotal API Keys on the Dark Web appeared first on Cyber Security News.