Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
20 IOCs
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
Excerpt
LiteLLM 1.107.0 delivers a credential stealer through Python startup hooks, while container build provenance points to a lookalike source repository used by the project’s release workflow. LiteLLM version 1.107.0 contains malicious Python startup files that collect cloud credentials, private keys, browser data, and authentication files for AI development tools. Socket’s AI scanner flagged the seven distributed wheels seven minutes after publication, and static analysis…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →20 indicators
IOC Relationship Graph
Building graph…