Hackers are increasingly targeting AI infrastructure to steal API keys, gain access to backend systems, maintain persistence, and mine cryptocurrency.
Microsoft has observed attacks against LiteLLM, RAGFlow, and Kestra three platforms that can hold sensitive model credentials, workflow permissions, database connections, and container access.
AI gateways, retrieval platforms, and workflow orchestration tools have become high-value targets because they sit between applications, users, data sources, and large language models.
A compromise can give attackers access to cloud credentials, provider API keys, internal services, and expensive computing resources.
Hackers Hit AI Infrastructure
In the LiteLLM case, attackers likely exploited an exposed gateway surface.
Microsoft linked the activity to a possible chain involving CVE-2026-42271, a command-execution flaw affecting LiteLLM MCP stdio test endpoints, and CVE-2026-48710, a Starlette host-header validation bypass that could weaken authentication in affected setups.
After obtaining execution, the attackers harvested environment variables from /proc/1/environ. These variables can contain model-provider API keys, LiteLLM master keys, database URLs, passwords, and access tokens.
They also accessed a LiteLLM PostgreSQL database and collected model configuration and virtual-key records.
The threat actors then downloaded payloads into temporary directories, used names that resembled legitimate Linux services, and deployed XMRig cryptomining software.
They also attempted to remove competing miners, modified SSH authorized_keys files, changed cron jobs, and used immutable file attributes to make removal harder.
The RAGFlow intrusion focused mainly on credential theft. Attackers performed suspected SSRF-style reconnaissance before modifying application files in the RAGFlow container.
They created a hidden Python hook that intercepted API keys when administrators added or updated LLM provider settings.
The hook captured details such as provider name, model name, API key material, and endpoint metadata. It then sent the information to attacker-controlled infrastructure while allowing the normal configuration process to continue.
Microsoft did not confirm which vulnerability enabled the RAGFlow compromise, though several publicly known flaws may offer relevant technical context.
Kestra, a workflow orchestration platform, was abused for direct shell execution.
Microsoft assessed that attackers likely exploited CVE-2026-49869, a critical authentication-bypass vulnerability that could let an unauthenticated attacker create and run a malicious workflow.paste.txt
The attacks show that AI infrastructure should be treated as critical control-plane technology, not merely as another application.
A compromised model gateway can expose provider credentials and databases; a compromised retrieval system can capture new credentials; and a workflow engine can provide a route to shell access and container discovery, Microsoft said.
Indicators of Compromise
| Indicator | Type | Associated activity |
|---|---|---|
45.150.109[.]151 | IPv4 | Scanning and reconnaissance infrastructure targeting multiple AI workloads |
135.125.10[.]56:19888 | IPv4:Port | RAGFlow exploitation C2 and LLM API-key exfiltration endpoint |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
