Malicious LiteLLM 1.107.0 version steals credentials and implants a remote access trojan
Malicious LiteLLM release harvests credentials, deploys remote access trojan
On Wednesday, attackers published a malicious LiteLLM 1.107.0 version through PyPI and a Docker repository, bundling an infostealer and a remote access trojan, and security teams subsequently quarantined the package. The malicious code was implanted through commits to a counterfeit GitHub repository, Berri-AI/litellm, in cook.pth, cook.py and sitecustomize.py, of which sitecustomize.py loads when the Python interpreter starts and polls the attacker infrastructure every hour awaiting instructions. The stealer reads credentials and cookies from Chrome, Firefox, Edge and Safari, AWS, GCP and Azure cloud credentials, and API keys from vendors including OpenAI, Anthropic and Cohere, as well as SSH private keys, encrypts them and POSTs them to www[.]litellm[.]dev/healthcheck.
The material lists the implanted files, exfiltration addresses and detection paths of the malicious LiteLLM 1.107.0, which can be used to check CI runners and agent containers.