FlagThis — Daily Cybersecurity Intelligence Briefing

Threat actor TeamPCP executed a targeted supply chain attack by compromising PyPI maintainer credentials to inject malicious code into LiteLLM (v1.82.7, 1.82.8) and PyTorch Lightning (v2.6.2, 2.6.3). The attackers utilized .pth file manipulation to achieve silent code execution during Python interpreter initialization, bypassing traditional import-based detection. The campaign exfiltrated 153GB of data—including AWS, GCP, Azure tokens, SSH keys, and CI/CD secrets—from approximately 2,500 organizations. The attack window lasted three hours before PyPI quarantine, highlighting a systemic shift toward targeting AI infrastructure and leveraging "slopsquatting" to exploit LLM-generated package hallucinations.

Threat actors are leveraging blind prompt injection against exposed LiteLLM gateways and Model Context Protocol (MCP) servers to achieve Remote Code Execution (RCE) on host infrastructure. By manipulating AI agents via indirect instructions, attackers bypass standard input filters to execute arbitrary code, facilitating memory credential theft. This attack chain allows for the exfiltration of API keys and cloud secrets, enabling lateral movement into production cloud environments for data exfiltration or the deployment of cryptominers. Immediate remediation requires strict input sanitization, sandboxing of agent tool-connectors, and the implementation of Zero Trust access controls for all AI gateways.

LiteLLM, a centralized LLM orchestration library, was targeted in a supply chain attack involving the distribution of malicious PyPI packages. Attackers integrated obfuscated Python code to establish a backdoor within the library's initialization and request-handling logic. This compromise enables the exfiltration of high-privilege API keys and sensitive prompt metadata to attacker-controlled C2 infrastructure via outbound HTTP requests. By compromising the orchestration layer, threat actors gain an intercept point for all traffic routing to multiple LLM providers, creating a systemic risk for enterprise AI governance and enabling subsequent prompt injection attacks against integrated AI agents.