Supply chain attacks are surging, and threat actors are turning their crosshairs toward artificial intelligence infrastructure.
In a highly sophisticated campaign, a threat actor group known as TeamPCP weaponized the widely used open-source Python library, LiteLLM, transforming it into a stealthy credential-harvesting tool.
Because LiteLLM serves as a unified gateway to over 100 AI providers, a single breach gave attackers simultaneous access to numerous cloud platforms and developer environments.
TeamPCP Weaponizes LiteLLM
The breach began with a precursor attack on Trivy, a popular vulnerability scanner. Hackers spoofed legitimate maintainer identities to push a malicious version to Trivy’s GitHub repository.
When LiteLLM’s CI/CD pipeline used the compromised Trivy scanner, the malware scraped the runner’s memory to steal a PYPI_PUBLISH token.
Using this stolen token, TeamPCP bypassed LiteLLM’s source code repository entirely to publish two malicious package versions.
Version 1.82.7 uses Base64-encoded source injection directly into the proxy_server.py file, which is executed the moment the LiteLLM proxy starts.
Version 1.82.8 uses file injection by adding litelllm_init.pth to the site-packages directory, activating at Python interpreter startup without requiring an explicit import.
Once the poisoned LiteLLM packages execute, they unleash a three-stage payload designed for aggressive data collection, secure exfiltration, and long-term persistence.
The malware immediately hunts for highly sensitive environment variables and cloud configuration files. The credential-harvesting URLs are currently categorized, and major security vendors block the hashes of the malicious PyPI versions.
Data collection targets AI provider keys (OpenAI, Anthropic, Azure), cloud metadata (AWS, GCP, Azure), and local configuration files like ~/.kube/config.
Stolen data is encrypted using AES-256-CBC, archived into a tar file, and sent to a malicious server via curl.
Persistence is achieved by dropping a Sysmon.py script to establish a remote code-execution backdoor and by checking a command-and-control server every 50 minutes for new payloads.
Indicators of Compromise
| Indicator Type | IOC | Description |
|---|---|---|
| Exfiltration URL | hxxps[:]//models[.]litellm[.]cloud/ | Destination for stolen data |
| C2 Server | hxxps[:]//checkmarx[.]zone/raw | Persistence polling URL |
| Hash (SHA-1) | 2d94efc6d49e05b314a9da55804f6a0d57154b18 | litellm_init.pth (version 1.82.8) |
| Hash (SHA-1) | 9e7587b990ae57319a6afedeba3b8873f6238206 | proxy_server.py (version 1.82.7) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
