LiteLLM Supply Chain Attack Harvests Credentials from 2,500 Firms
LiteLLM AI Supply Chain Attack Exposes 2,500+ Companies
Impact Scope
People Affected
Over 2,500 organizations and 434,000 CI/CD pipelines
Industries Affected
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Full Report(when first published)
Executive Summary
Security firm CloudSEK has uncovered a massive supply chain attack targeting LiteLLM, a popular open-source Python package that acts as a universal interface for over 100 Large Language Model (LLM) APIs. The attack, attributed to the threat group Team PCP, involved publishing malicious versions of LiteLLM to the Python Package Index (PyPI). These trojanized packages were designed to steal sensitive credentials from the environments where they were installed, potentially compromising over 2,500 organizations and hundreds of thousands of CI/CD pipelines. The incident highlights the growing risk of supply chain attacks as a primary vector for compromising modern AI and cloud infrastructure.
Threat Overview
The attack occurred in March 2026 when Team PCP successfully published malicious versions 1.82.7 and 1.82.8 of the LiteLLM package on PyPI. Because LiteLLM is used to manage and route requests to various LLM providers, its configuration often contains a treasure trove of secrets, including API keys for services like OpenAI, Azure, and Google's Vertex AI, as well as cloud provider credentials (AWS, GCP) and Kubernetes configurations. The malicious packages were engineered to harvest these secrets and exfiltrate them to an attacker-controlled server.
Although the malicious packages were only available on PyPI for a short window (between 40 minutes and 3 hours), the high download rate of LiteLLM means that thousands of automated build systems and developer environments likely pulled in the compromised versions. The attackers used sophisticated evasion techniques, such as using .pth files, which execute code automatically upon Python interpreter startup, making the malicious activity harder to detect than a typical setup.py script.
Technical Analysis
The attack chain demonstrates a deep understanding of modern development practices and CI/CD pipelines.
- Compromise of Upstream Dependencies: The campaign began with the compromise of other development tools, such as Aqua Security's Trivy, which provided Team PCP with the initial set of credentials needed to escalate their access.
- Publishing Malicious Package (T1195.001): The attackers used their compromised access to publish trojanized versions of LiteLLM to the official PyPI repository. This is a classic supply chain attack known as typosquatting or, in this case, direct compromise.
- Credential Access (T1552.001): The malicious code within the package was designed to scan the environment for credentials stored in files, environment variables, and configuration management systems.
- Exfiltration (T1048): Harvested secrets, including API keys, SSH keys, and cloud credentials, were exfiltrated to an external server controlled by Team PCP.
- Execution (T1106): The use of
.pthfiles for execution is a stealthy technique. These files are intended for path manipulation but can be abused to run arbitrary code every time a Python application is started, establishing a form of persistence.
Impact Assessment
This is arguably the most significant supply chain attack on AI infrastructure to date. The compromise of LiteLLM provides attackers with the "keys to the kingdom" for an organization's entire AI ecosystem. With the stolen credentials, attackers can:
- Incur massive costs by abusing LLM APIs and cloud computing resources.
- Steal sensitive data passed to and from LLMs.
- Poison AI models or manipulate their outputs.
- Pivot from the AI environment into the broader corporate network.
The FBI has warned that the credentials harvested in this breach are likely to be used in future attacks for months or years to come, making this a long-tail threat that requires immediate and thorough remediation.
IOCs — Directly from Articles
- Malicious LiteLLM versions:
1.82.7,1.82.8
Cyber Observables — Hunting Hints
The following patterns can help identify exposure to this attack:
requirements.txt, poetry.locksite-packages/**/*.pth.pth files in Python environments for any suspicious or unexpected code that is not a simple path.Detection & Response
- Dependency Scanning: Immediately scan all projects and environments for the presence of the malicious LiteLLM versions. Tools like
pip-auditor commercial Software Composition Analysis (SCA) tools can identify vulnerable dependencies. - Credential Rotation: Assume that all secrets in any environment where the malicious package could have been installed are compromised. Initiate a full rotation of all LLM API keys, cloud credentials, SSH keys, and other secrets.
- Log Analysis: Analyze cloud and application logs for any signs of anomalous activity since March 2026. Look for unexpected API calls, data access, or resource creation. D3FEND's Cloud Log Analysis is critical here.
- CI/CD Pipeline Audit: Review CI/CD pipeline logs to determine if and when the malicious packages were downloaded and installed.
Mitigation
- Use Trusted Dependencies (M1051): Pin dependencies to specific, known-good versions. Use a local or private package repository that only contains vetted packages.
- Least Privilege in CI/CD (M1026): Build pipelines should not have long-lived, powerful credentials. Use short-lived tokens (e.g., via OIDC) that are scoped to the minimum required permissions for the job.
- Network Egress Filtering (M1037): Restrict outbound network access from build servers and CI/CD runners to only a known-good allowlist of domains (e.g., your package repository, source control). This prevents exfiltration to attacker-controlled servers.
- Software Bill of Materials (SBOM): Maintain a detailed SBOM for all applications. This allows for rapid identification of all systems affected by a newly discovered vulnerability in a dependency.
Timeline of Events
Article Updates
August 12, 2026
Severity increasedNew details reveal sophisticated secondary exfiltration method using victim's GitHub to create public repositories for stolen credentials.
The attack, attributed to Team PCP, utilized a sophisticated secondary exfiltration technique. If direct outbound connections were blocked, the malware would leverage the victim's own GitHub credentials to create a new public repository. Stolen secrets were then uploaded as release assets to this repository, making the exfiltrated data appear as legitimate activity and publicly exposing sensitive information. This method highlights the advanced nature of the threat and the critical need for auditing source control activity.
Update Sources:
August 14, 2026
New details emerge on LiteLLM supply chain attack, revealing 'SANDCLOCK Stealer' malware and a 153GB data dump of secrets from 2,488 companies.
Further analysis of the LiteLLM supply chain attack by Hudson Rock has revealed the specific malware used, dubbed 'SANDCLOCK Stealer.' This stealer harvested a 153GB database of secrets from 2,488 corporate domains. The attack chain is now more clearly understood, beginning with the compromise of the Trivy vulnerability scanner's CI/CD pipeline, which was then used to steal PyPI publishing tokens for the LiteLLM project, enabling the publication of malicious versions 1.82.7 and 1.82.8.
Update Sources:
August 22, 2026
New details emerge on LiteLLM attack vector (compromised maintainer account) and expanded list of stolen credentials.
New information clarifies the attack vector, indicating that malicious LiteLLM packages were likely published to PyPI via a compromised maintainer's account. The scope of stolen credentials is further detailed, including cloud provider keys (AWS, GCP, Azure), repository tokens, SSH keys, and Kubernetes configuration files. Organizations are urged to rotate all potentially exposed credentials. Detection guidance now includes using D3FEND's File Hashing technique for identifying affected systems.
Update Sources:
Timeline of Events
Team PCP publishes malicious versions of LiteLLM to PyPI.
The FBI issues a FLASH advisory warning that actors will likely weaponize the harvested credentials.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.