Terabytes of credentials, including those belonging to Microsoft, Amazon, Cisco, Samsung, and Salesforce, have been exposed in a supply-chain attack on LiteLLM, an open source tool used to streamline AI-driven software development.
The nature of the breach
The exposure was revealed by security firms CloudSEK and Hudson Rock, which reported finding cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider keys that could grant access to more than 2,500 organizations. The credentials were harvested during a 40-minute window in March while victims downloaded compromised versions of the software from the official Python Package Index repository.
Hudson Rock analyzed a 195TB file to make the discovery, while CloudSEK identified a wide variety of exposed secrets. The compromised code accessed the memory of infected machines, scraped its contents, and exfiltrated it through an attacker-controlled channel. This resulted in some 434,000 CI/CD software pipelines having their credentials exposed after running the malicious versions of LiteLLM.
Related: Trump vaccine directive draws medical criticism
Researchers often struggled to identify the organizations behind the data. For example, an email address from the @siriusxm.com domain pointed to a breach at AdsWizz, a subsidiary of the satellite broadcaster, rather than the parent company itself.
Who was affected
The researchers had high confidence that several major organizations were affected, including Regeneron Pharmaceuticals, the London Stock Exchange Group, and Krungthai Bank. The dumped variables contained active database passwords, third-party API keys, and cloud credentials without any identifiable company email, custom domain string, or internal server name.
Many CI/CD pipelines are configured generically, meaning countless organizations currently have active secrets sitting in this database, completely unaware of their exposure. The data dump included a trove of internal corporate secrets, exposing sensitive tokens for platforms such as Salesforce (SALESFORCE_CLIENT_SECRET), Slack (SLACK_SIGNING_SECRET), and Microsoft Azure environments.
The LiteLLM compromise was the result of a previous supply-chain attack that infected the widely used vulnerability scanner Trivy. Other software infected in the campaign includes KICS and the Telnyx Python SDK. TeamPCP, a group largely made up of teenagers, took credit for the attack, and researchers have largely corroborated the claim.
Related: Spacecraft suffers heat damage and thruster failure
While organizations are urged to rotate all credentials in their pipelines, some affected parties have not reacted with the urgency the situation demands. Independent security researcher Kevin Beaumont reported that after discovering credentials dating back to March, he tested them against a “biggest US techcos” and found that almost every one worked. He noted that one impacted organization had told him they had rotated the credentials and dismissed the issue, but Beaumont was able to successfully authenticate using the old tokens.
This attack highlights how supply chains have evolved to make a single upstream breach affect thousands of companies simultaneously. A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested.
The incident pushes cybersecurity into a new area regarding the type of response required from the industry.