AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5776 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TeamPCP Backdoored LiteLLM 1.82.7/1.82.8 Install or litellm_init.pth Drop — Exploitation

Detects the supply-chain entry point of the TeamPCP LiteLLM compromise (TL-2026-5776): a pip/uv/poetry install pinned to the malicious litellm 1.82.7 or 1.82.8 releases, or creation of litellm_init.pth (base64 payload that executes at every Python interpreter start) in site-packages. Behaviour-first: fires on the file drop or the explicit bad-version install, on Windows or Linux Sysmon telemetry. Covers T1195.001/T1195.002 and Python execution (T1059.006).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1195.002, T1059.006
• Data sources: sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), sysmon for linux (sysmon:linux), index=sysmon
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon earliest=-24h (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="sysmon:linux") ((EventCode=11 TargetFilename="*litellm_init.pth") OR (EventCode=1 (CommandLine="*litellm==1.82.7*" OR CommandLine="*litellm==1.82.8*" OR CommandLine="*litellm-1.82.7*" OR CommandLine="*litellm-1.82.8*"))) | eval indicator=if(EventCode=11, "litellm_init.pth payload dropped into a Python environment (litellm 1.82.8)", "install of backdoored litellm 1.82.7 or 1.82.8 (TeamPCP)") | stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicator values(CommandLine) as command_line values(TargetFilename) as dropped_file values(Image) as process by host, User | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen host User process indicator command_line dropped_file count

Microsoft KQL

let lookback = 24h;
union
(DeviceFileEvents
| where Timestamp > ago(lookback)
| where FileName =~ 'litellm_init.pth' and ActionType in ('FileCreated','FileModified')
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal='litellm_init.pth dropped', Detail=FolderPath, Process=InitiatingProcessCommandLine),
(DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ('litellm==1.82.7','litellm==1.82.8','litellm-1.82.7','litellm-1.82.8')
| project Timestamp, DeviceName, AccountName, Signal='install of backdoored litellm', Detail=FileName, Process=ProcessCommandLine)
| sort by Timestamp desc

Sigma

title: Backdoored LiteLLM litellm_init.pth Created in Python Environment
id: 1a6e4c0d-8f32-4b57-9c1e-2d7a5b3f9e01
status: experimental
description: Detects creation of litellm_init.pth, the .pth file shipped in the malicious litellm 1.82.8 PyPI release (TeamPCP supply-chain attack) that executes a base64 payload every time the Python interpreter starts.
references:
  - https://research.jfrog.com/post/litellm-compromised-teampcp/
  - https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.006
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|endswith: 'litellm_init.pth'
  condition: selection
falsepositives:
  - None expected; litellm_init.pth is not part of any legitimate litellm release
level: critical

Known false positives:

• Security researchers or malware analysts deliberately installing litellm 1.82.7/1.82.8 in a sandbox
• Vulnerability scanners or SCA tools that download and unpack the quarantined release for analysis

Tuning notes: Replace index=sysmon with the index that holds your Sysmon (Windows or Linux) data. Installs driven by requirements or lock files do not show the version on the command line, so pair this rule with SCA/SBOM inventory checks for litellm 1.82.7/1.82.8. Exclude known analysis sandboxes by host.

• 🔒 CanisterWorm npm postinstall env-compat.cjs Stealer Execution — Exploitation · unlock with TL Creds
• 🔒 Mini Shai-Hulud Claude Code SessionStart Hook Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 Supply-Chain Stealer Credential Sweep and [indicator] Exfiltration — C2/Exfiltration · unlock with TL Creds
• 🔒 Install of Compromised Namastex / CanisterWorm npm Package Versions — Exploitation · unlock with TL Creds
• 🔒 LiteLLM Payload Privileged node-setup-* Pod in kube-system — Post-Exploitation/Lateral Movement · unlock with TL Creds
• 🔒 Web Proxy Traffic to TeamPCP/CanisterWorm Exfiltration and Staging Endpoints — C2 · unlock with TL Creds
• 🔒 LiteLLM Payload sysmon.service User-Systemd Backdoor and Stage-2 Fetch — Post-Exploitation · unlock with TL Creds
• 🔒 TeamPCP / CanisterWorm C2 and Exfiltration DNS Resolutions — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5776.

Sample indicators (3 of 28)

• Domain: models[.]litellm[.]cloud
• File hash: c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839
• Domain: checkmarx[.]zone

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

Recorded Future's Insikt Group analysis, covering 2025-07-31 to 2026-07-31 (the page itself states no publication date), describes AI as both a target and a tool for threat actors. Most observed incidents use AI to speed up established tradecraft rather than create new attack classes. AI coding assistants, LLM proxy packages and agent tooling are attractive targets because they hold API keys, cloud credentials, OAuth tokens and source-code access.

Supply-chain incidents cited by the report and corroborated by primary sources: (1) LiteLLM (late Feb/Mar 2026 per the report; JFrog and others date the malicious PyPI uploads to 2026-03-24). Versions 1.82.7 and 1.82.8 contained a credential stealer, Kubernetes lateral-movement logic and a systemd backdoor. The compromise is attributed to TeamPCP and came through a compromised Trivy v0.69.4 binary in LiteLLM's unpinned CI/CD pipeline, which leaked publishing tokens. (2) Namastex Labs npm packages (April 2026; Socket report 2026-04-22) were compromised with the self-propagating CanisterWorm, which steals credentials and wallet data at install time, exfiltrates to a webhook and an Internet Computer canister, and republishes itself to npm and PyPI using stolen tokens. Socket notes TeamPCP-style tradecraft. (3) The Mini Shai-Hulud expanded campaign (May 2026; Microsoft identified it on 2026-05-11) compromised 170+ npm packages and 2 PyPI packages (404 malicious versions per Microsoft). Its roughly 2.3 MB triple-obfuscated stealer persists via a Claude Code SessionStart hook in .claude/settings.json, plus .claude/setup.mjs and .claude/router_runtime.js, and is committed into victim repositories via GitHub GraphQL.

Other activity in the report: The Gentlemen ransomware uses LLMs to rank stolen data by sensitivity, regulatory status and likely payment and to set demands, shortening time to extortion. State-sponsored use includes a multi-agent AI framework (up to eight agents) used against government entities in Asia (reported as Taiwanese government in one passage), Russian actors using AI for malware development, and a Pakistan-based actor producing LLM-generated 'vibeware' abusing Discord, Slack or Google Workspace. Fraudulent Claude developer tool pages and OpenClaw wallet-phishing pages, a phishing operation against French retirees, an illicit token-relay market for model access, and an AI agent escaping test environments are also referenced. Recorded Future's AI Malware Maturity Model (AIM3, Levels 1-5) frames the maturity of AI-enabled malware.

The source lists no CVEs, hashes, IPs or domains of its own; the IOCs below come from the primary incident reports (JFrog, Socket). BeaconBeagle lookups for the network IOCs returned HTTP 502 and could not be completed. Severity is analyst-assigned, not stated by the source.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059.006 Python; T1059.007 JavaScript

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Private Keys; T1552.007 Container API; T1555.003 Credentials from Web Browsers

Persistence

T1543.002 Systemd Service; T1546 Event Triggered Execution

Exfiltration

T1567 Exfiltration Over Web Service

Privilege Escalation

T1611 Escape to Host

Remediation

Patches

• Upgrade litellm to v1.83.0 or later (released via rebuilt pipeline)

Immediate actions

• Check all environments, including transitive dependencies, for litellm 1.82.7/1.82.8 and the compromised Namastex package versions; remove and rebuild from clean state
• Rotate all credentials reachable from affected hosts and CI: npm/PyPI/GitHub tokens, cloud keys, SSH keys, Kubernetes secrets, LLM/API keys and OAuth tokens
• Inspect .claude/settings.json (SessionStart hooks), .claude/setup.mjs, .claude/router_runtime.js and ~/.claude.json MCP configs for tampering; remove malicious hook files
• Block models.litellm.cloud, checkmarx.zone and telemetry.api-monitor.com and the ICP canister cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io
• Stop and remove sysmon.service and ~/.config/sysmon/; delete node-setup-* pods in kube-system

Workarounds

• Set ignore-scripts=true in .npmrc or use npm install --ignore-scripts to neutralize preinstall/postinstall hooks

Longer-term hardening

• Pin dependency and CI tool versions with checksum verification (e.g., Trivy) and use isolated release pipelines
• Limit AI agent access to sensitive systems, require human approval for consequential actions, and maintain independent monitoring and kill switches
• Monitor infostealer logs and dark web channels for exposed AI subscriptions, developer API keys and OAuth tokens
• Audit AI dependencies, code-generation plugins and open-weight model repositories for malicious command injection or backdoors

Affected and fixed versions

• BerriAI — litellm (PyPI)
  Vulnerable versions: 1.82.7; 1.82.8
  Fixed in: 1.83.0
• Namastex Labs — @automagik/genie, pgserve (npm)
  Vulnerable versions: @automagik/genie 4.260421.33-4.260421.39; pgserve 1.1.11-1.1.13
• Anthropic — Claude Code (persistence target of Mini Shai-Hulud)
• TanStack and others — npm and PyPI packages in Mini Shai-Hulud (170+ npm, 2 PyPI)
  Vulnerable versions: 404 malicious versions per Microsoft

Timeline

• 2025-07-31 Start of Insikt Group's analysis window; 103 AI-involved malicious incidents identified through 2026-07-31
• 2026-03-20 Earlier CanisterWorm campaign affected 141 packages between March 20 and 23 (per Socket research cited in coverage)
• 2026-03-24 Malicious litellm 1.82.7 and 1.82.8 published to PyPI via compromised Trivy v0.69.4 in CI/CD; attributed to TeamPCP; project later quarantined
• 2026-04-21 Namastex npm packages (@automagik/genie 4.260421.33-39, pgserve 1.1.11-13 and others) published with CanisterWorm payload at about 22:14 UTC
• 2026-04-22 Socket publishes analysis of the Namastex npm compromise (CanisterWorm, npm and PyPI propagation, ICP canister exfiltration)
• 2026-05-11 Mini Shai-Hulud resurgence identified by Microsoft; 84 malicious versions across 42 @tanstack/* packages published in a six-minute window; Claude Code SessionStart hook persistence
• 2026-05-19 Further Mini Shai-Hulud waves compromise the AntV npm ecosystem (per secondary reporting; counts vary by source)
• 2026-07-31 End of Insikt Group's analysis window; the report's publication date is not stated

Sources cited

• AI Is Both Target and Tool for Threat Actors (Recorded Future / Insikt Group) Recorded Future · Research
• Inside the LiteLLM supply chain compromise (Trend Micro) Trend Micro · Vendor report
• Popular litellm Python package is the latest victim of TeamPCP's ongoing supply chain attack (JFrog) research.jfrog.com · Research · 2026-03-24
• Namastex npm packages compromised: CanisterWorm (Socket) socket.dev · Research · 2026-04-22
• Shai-Hulud 2.0 guidance, incl. Mini Shai-Hulud expanded campaign May 2026 (Microsoft) Microsoft · Vendor report · 2026-05-11
• APT36 nightmare: vibeware (Bitdefender) businessinsights.bitdefender.com · Vendor report
• GreyVibe (WithSecure) withsecure.com · Vendor report
• Inside a multi-agent AI framework used to compromise government entities in Asia (Dream) dreamgroup.com · Research
• Mini Shai Hulud: Cross-ecosystem supply chain worm targeting npm & PyPI (Expel) expel.com · Blog
• More supply chain compromises: Namaste, xinference, and more (Expel) expel.com · Blog
• Claude fraud malware campaign targeting AI developer tools (7AI) blog.7ai.com · Blog
• Popular LiteLLM PyPI package compromised in TeamPCP supply chain attack (BleepingComputer) BleepingComputer · News

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

More from TeamPCP

• Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)
• Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)
• Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)
• Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload
• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
• Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception

Previous and next in supply chain

• Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk) Previous report

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs