Overview
On October 21, 2026, threat actors published a trojanised version of LiteLLM—version 1.107.0—to the Python Package Index (PyPI) and embedded the malicious payload within official container images. LiteLLM is a widely used open-source library that provides a unified interface for calling large language model APIs, making it a high-value target for supply chain compromise. Microsoft Security Research disclosed the campaign on October 23, 2026, after observing active payload execution on Windows and macOS endpoints.
The attack is particularly dangerous because the payload does not require an explicit import litellm statement. By abusing Python interpreter startup mechanisms—specifically path extensions and site-specific configuration hooks—the credential collector can execute the moment Python is launched in an affected environment. This means routine operations such as installing an unrelated package via pip can silently activate the malware.
Technical Analysis
Microsoft identified two distinct execution paths embedded in the compromised wheels:
1. Path extension credential collector: A file placed in a location Python scans during interpreter initialisation. This collector targets authentication material from developer tools, AI applications, cloud provider credential stores, web browsers, and infrastructure tooling.
2. Unix-oriented site loader: Persisted through site-specific configuration (e.g., .pth files or sitecustomize.py), ensuring execution on affected Linux and macOS systems across sessions.
A third component—a database module—attempted to extract credential records and model-configuration data directly from the LiteLLM proxy database, specifically targeting AI API keys and provider configurations stored by the proxy service.
Endpoint telemetry on both Windows and macOS confirmed the collector’s full kill chain: local discovery of credential material, encryption of harvested data, and outbound exfiltration. In one documented Windows case, a developer invoking pip to install an unrelated dependency triggered the full collector sequence.
A critical operational warning from Microsoft: investigators must not start Python or pip inside a suspect environment to assess exposure. Doing so can trigger payload execution and initiate credential exfiltration.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| ATLAS AML.T0010 | AI Supply Chain Compromise | Malicious package published to PyPI targeting AI tooling consumers |
| ATLAS AML.T0115 | Publish Poisoned AI Artifacts | Trojanised wheel and container images distributed through official channels |
| ATLAS AML.T0083 | Credentials from AI Agent Configuration | Database module reads LiteLLM proxy credential and model config records |
| ATLAS AML.T0098 | AI Agent Tool Credential Harvesting | Broad credential sweep across AI application credential stores |
| OWASP LLM05 | Supply Chain Vulnerabilities | Compromise introduced at the package distribution layer |
| OWASP LLM06 | Sensitive Information Disclosure | AI API keys, cloud credentials, and model configs exfiltrated |
Impact Assessment
Any developer, MLOps engineer, or AI platform operator who installed LiteLLM 1.107.0 or deployed its container images between October 21 and the disclosure date should assume credential compromise. The scope of harvested material is broad: cloud provider keys, AI API tokens (including those for LLM providers routed through the proxy), browser-stored credentials, and infrastructure secrets. Organisations running LiteLLM as a centralised AI gateway face amplified risk, as a single compromised proxy instance may expose API keys for multiple downstream LLM providers.
Mitigation & Recommendations
- Isolate immediately: Do not execute Python, pip, or any Python-based tooling inside environments where LiteLLM 1.107.0 may be installed. Use out-of-band inspection methods.
- Verify and roll back: Audit installed package versions and container image digests. Downgrade to a verified clean release or await a patched version from the LiteLLM maintainers.
- Rotate all credentials: Treat all secrets accessible from affected environments as compromised. Prioritise cloud provider keys, LLM API tokens, and any credentials stored in browsers or developer tools on affected hosts.
- Review LiteLLM proxy logs: Check for anomalous database queries or outbound connections from proxy instances.
- Enable Defender detections: Microsoft Defender has published indicators of compromise (IoCs) and detection guidance aligned to this campaign.