Attackers continue to attack LiteLLM
Attackers continue to attack LiteLLM; Wiz says it has begun observing abuse of stolen credentials, initially related to LLMJacking. Researcher Johann Rehberger (@wunderwuzzi23) cited Wiz's update and made the above judgment, while linking his previously written analysis article explaining why he believes LiteLLM was targeted (https://embracethered.com/blog/posts/2026/hijacking-litellm-for-fun-and-profit/）。Wiz indicates that its crawler discovered this supply chain incident on the morning of that day, US Eastern Time, and has continued to update and track it since, having observed credential abuse activity from two IPs, 168.100.8[.]57 and 165.227.201[.]8.
Attackers continue to target LiteLLM.
A while ago I wrote up why I think that's the case
https://embracethered.com/blog/posts/2026/hijacking-litellm-for-fun-and-profit/
We (@wiz_io ) continue to update our post on the LiteLLM supply chain incident, which we've been tracking since our crawler identified it this morning (eastern)
🧑🚒 We've begun to see abuse of stolen credentials - initially related to LLMJacking - from the following IPs
* 168.100.8[.]57
* 165.227.201[.]8View the quoted post on X