Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 1 actorExploits 1 CVE

LiteLLM

LiteLLM was compromised in a March 2026 software supply-chain campaign attributed in the provided reporting to TeamPCP, also tracked as DeadCatx3, PCPcat, ShellForce, CanisterWorm, and in one report as UNC6780. Using credentials reportedly stolen from LiteLLM’s CI/CD pipeline after that pipeline ran unpinned Trivy during the broader TeamPCP campaign, attackers published trojanized LiteLLM versions 1.82.7 and 1.82.8 to PyPI on March 24, 2026. The malicious code executed via Python: in version 1.82.7 it ran when importing litellm.proxy.proxy_server, while version 1.82.8 added litellm_init.pth, causing execution automatically on Python interpreter startup via Python’s site module without requiring an import.

Across the provided sources, the LiteLLM payload is described as a base64-decoded Python stealer consistent with TeamPCP tooling. Reported capabilities include host fingerprinting, filesystem credential theft, scraping secrets from CI/CD and developer environments, collecting cloud and Kubernetes credentials, SSH material, Docker and registry credentials, .env files, shell histories, and other sensitive files. Multiple reports state the broader TeamPCP malware also scraped GitHub Actions Runner.Worker process memory via /proc/<pid>/mem to recover secrets, queried cloud metadata services, and on non-CI Linux systems established persistence by dropping Python scripts under paths such as ~/.config/sysmon/ or ~/.local/share/pgmon/ and creating user-level systemd services. One mention context specifically describes persistence via a sysmon.service polling checkmarx.zone/raw. The campaign also reportedly supported fallback exfiltration through GitHub repository and release creation using stolen GitHub tokens.

For LiteLLM specifically, the provided content associates command-and-control and exfiltration with models.litellm.cloud, and one report states exfiltration used the HTTP header X-Filename: tpcp.tar.gz. Other mention contexts describe a triple-nested base64 payload and Kubernetes lateral movement tooling. The malicious LiteLLM releases were published to PyPI using stolen credentials and were later quarantined by PyPI on March 24, 2026. High-confidence affected versions directly mentioned in the content are 1.82.7 and 1.82.8.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2026-33634Trivy Supply Chain Compromise

The attackers then published malicious versions 1.82.7 and 1.82.8 directly to PyPI, bypassing the normal release process. The malware used a Python .pth file... every python, pip, or pytest command would trigger the credential stealer.

via sans blogsans.org
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamPCP

Part 2 covered the malicious LiteLLM package.

via mend io blogmend.io
MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

7 techniques
T1078Valid AccountsEvidence4

Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT

T1078.004Cloud AccountsEvidence1

The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure, run commands inside containers, and exfiltrate sensitive data.

T1133External Remote ServicesEvidence1

Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure.

T1190Exploit Public-Facing ApplicationEvidence1

The irony is that Mercor was hacked via a third-party open source tool called LiteLLM.

T1195Supply Chain CompromiseEvidence9

Earlier this month, Mercor said that it was "one of thousands of companies" affected by the LiteLLM supply-chain attack.

T1195.001Compromise Software Dependencies and Development ToolsEvidence5

The severity of this dependency was demonstrated in March 2026, when attackers compromised the LiteLLM package through dependency confusion, injecting malicious code directly into the request-handling pipeline of every deployment that pulled the poisoned release.

T1199Trusted RelationshipEvidence1

By abusing valid credentials and trusted CI/CD workflows, attackers are bypassing traditional security controls, enabling widespread access across build systems, cloud infrastructure, and customer environments.

Execution

4 techniques
T1059Command and Scripting InterpreterEvidence3

The threat actor modified these workflows to execute malicious code during CI runs...

T1059.006PythonEvidence2

Packages contain a three-stage credential harvesting payload embedded via a .pth auto-execution file... The malicious LiteLLM package didn’t run obvious, easily-flagged code. It used a .pth file... that auto-executes on interpreter startup.

T1574Hijack Execution FlowEvidence1

The LiteLLM payload bypassed standard SAST tools through a technique known as .pth file injection . When a package containing a .pth file is installed in the Python site-packages directory, the interpreter automatically reads it during initialization before the primary script is ever executed or imported.

T1574.006Dynamic Linker HijackingEvidence1

The malware leveraged a .pth file, which executes automatically during Python interpreter startup. This means the payload runs in most Python processes without needing the package to be explicitly imported...

Persistence

7 techniques
T1037Boot or Logon Initialization ScriptsEvidence1

The malware leveraged a .pth file, which executes automatically during Python interpreter startup. This means the payload runs in most Python processes without needing the package to be explicitly imported

T1078Valid AccountsEvidence4

Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT

T1078.004Cloud AccountsEvidence1

The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure, run commands inside containers, and exfiltrate sensitive data.

T1133External Remote ServicesEvidence1

Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure.

T1505Server Software ComponentEvidence1

These packages contained credential-stealing and backdoor code designed to harvest SSH keys, cloud credentials, Kubernetes secrets, database credentials, environment variables, and other sensitive data, while establishing persistent access to attacker-controlled infrastructure.

T1543Create or Modify System ProcessEvidence1

Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

T1543.002Systemd ServiceEvidence1

Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

Privilege Escalation

5 techniques
T1037Boot or Logon Initialization ScriptsEvidence1

The malware leveraged a .pth file, which executes automatically during Python interpreter startup. This means the payload runs in most Python processes without needing the package to be explicitly imported

T1078Valid AccountsEvidence4

Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT

T1078.004Cloud AccountsEvidence1

The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure, run commands inside containers, and exfiltrate sensitive data.

T1543Create or Modify System ProcessEvidence1

Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

T1543.002Systemd ServiceEvidence1

Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

Stealth

5 techniques
T1027Obfuscated Files or InformationEvidence1

The TeamPCP payload dropped a heavily obfuscated Base64-encoded execution string into a hidden .pth file ... During the Bitwarden CLI compromise on April 22, the core payload bw1.js was a massive 9.7 MB file processed through obfuscator.io, utilizing a 43,436-entry string lookup table

T1078Valid AccountsEvidence4

Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT

T1078.004Cloud AccountsEvidence1

The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure, run commands inside containers, and exfiltrate sensitive data.

T1574Hijack Execution FlowEvidence1

The LiteLLM payload bypassed standard SAST tools through a technique known as .pth file injection . When a package containing a .pth file is installed in the Python site-packages directory, the interpreter automatically reads it during initialization before the primary script is ever executed or imported.

T1574.006Dynamic Linker HijackingEvidence1

The malware leveraged a .pth file, which executes automatically during Python interpreter startup. This means the payload runs in most Python processes without needing the package to be explicitly imported...

Credential Access

4 techniques
T1528Steal Application Access TokenEvidence2

When the compromised action ran, it harvested LiteLLM’s PyPI publishing token.

T1552Unsecured CredentialsEvidence2

The payload searched for and exfiltrated over 50 categories of secrets SSH keys, AWS and GCP access tokens, Kubernetes secrets, crypto wallet keys, .env files, and API credentials for LLM providers like OpenAI, Anthropic, and Cohere.

T1555Credentials from Password StoresEvidence1

The payload searched for and exfiltrated over 50 categories of secrets... crypto wallet keys... and API credentials...

T1649Steal or Forge Authentication CertificatesEvidence2

The common thread among those incidents is that they all revolved around secrets, one way or another. Some used secrets as an initial access vector, and others were focused on collecting secrets from victim environments.

Discovery

2 techniques
T1526Cloud Service DiscoveryEvidence1

The attackers validated cloud keys taken from the Trivy, LiteLLM, and Checkmarx KICS compromises and used them to access cloud services, enumerate infrastructure...

T1613Container and Resource DiscoveryEvidence2

If a Kubernetes environment was detected, the payload attempted to deploy privileged pods to every node in the cluster.

Collection

3 techniques
T1005Data from Local SystemEvidence1

The TeamPCP malware specifically sought out these directories, intercepting proprietary prompts and unencrypted model weights directly from the development lifecycle.

T1074Data StagedEvidence1

Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure. Lateral movement and data staging begin.

T1213Data from Information RepositoriesEvidence1

Mercor lost roughly 4 terabytes of data through the LiteLLM open-source AI gateway, exposing training methodologies for OpenAI, Anthropic, and Meta in the process.

Command and Control

1 technique
T1105Ingress Tool TransferEvidence1

the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

The payload searched for and exfiltrated over 50 categories of secrets... Finally, the payload installed a systemd backdoor service that polled attacker-controlled infrastructure for additional binaries.

T1567.002Exfiltration to Cloud StorageEvidence1

execute commands in containers, and exfiltrate sensitive cloud data... Reviewing cloud logs for unexpected Amazon Simple Storage Service access, and Secrets Manager retrievals.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app11 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.