# AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

> Recorded Future (Insikt Group) identified 103 AI-involved malicious incidents between 2025-07-31 and 2026-07-31, mostly AI accelerating familiar attacks such as supply-chain compromise, phishing and extortion. AI developer tooling (LiteLLM, Namastex npm packages, Claude Code via Mini Shai-Hulud) is a prime target because it holds credentials and code access.

- **Published:** 2026-11-11T15:14:28Z
- **Last reviewed:** 2026-11-11T15:14:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5776
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5776.png
- **ID:** TL-2026-5776
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

Recorded Future's Insikt Group analysis, covering 2025-07-31 to 2026-07-31 (the page itself states no publication date), describes AI as both a target and a tool for threat actors. Most observed incidents use AI to speed up established tradecraft rather than create new attack classes. AI coding assistants, LLM proxy packages and agent tooling are attractive targets because they hold API keys, cloud credentials, OAuth tokens and source-code access.

Supply-chain incidents cited by the report and corroborated by primary sources: (1) LiteLLM (late Feb/Mar 2026 per the report; JFrog and others date the malicious PyPI uploads to 2026-03-24). Versions 1.82.7 and 1.82.8 contained a credential stealer, Kubernetes lateral-movement logic and a systemd backdoor. The compromise is attributed to TeamPCP and came through a compromised Trivy v0.69.4 binary in LiteLLM's unpinned CI/CD pipeline, which leaked publishing tokens. (2) Namastex Labs npm packages (April 2026; Socket report 2026-04-22) were compromised with the self-propagating CanisterWorm, which steals credentials and wallet data at install time, exfiltrates to a webhook and an Internet Computer canister, and republishes itself to npm and PyPI using stolen tokens. Socket notes TeamPCP-style tradecraft. (3) The Mini Shai-Hulud expanded campaign (May 2026; Microsoft identified it on 2026-05-11) compromised 170+ npm packages and 2 PyPI packages (404 malicious versions per Microsoft). Its roughly 2.3 MB triple-obfuscated stealer persists via a Claude Code SessionStart hook in .claude/settings.json, plus .claude/setup.mjs and .claude/router_runtime.js, and is committed into victim repositories via GitHub GraphQL.

Other activity in the report: The Gentlemen ransomware uses LLMs to rank stolen data by sensitivity, regulatory status and likely payment and to set demands, shortening time to extortion. State-sponsored use includes a multi-agent AI framework (up to eight agents) used against government entities in Asia (reported as Taiwanese government in one passage), Russian actors using AI for malware development, and a Pakistan-based actor producing LLM-generated 'vibeware' abusing Discord, Slack or Google Workspace. Fraudulent Claude developer tool pages and OpenClaw wallet-phishing pages, a phishing operation against French retirees, an illicit token-relay market for model access, and an AI agent escaping test environments are also referenced. Recorded Future's AI Malware Maturity Model (AIM3, Levels 1-5) frames the maturity of AI-enabled malware.

The source lists no CVEs, hashes, IPs or domains of its own; the IOCs below come from the primary incident reports (JFrog, Socket). BeaconBeagle lookups for the network IOCs returned HTTP 502 and could not be completed. Severity is analyst-assigned, not stated by the source.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1059.006 Python
- T1059.007 JavaScript
- T1543.002 Systemd Service
- T1546 Event Triggered Execution
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1552.007 Container API
- T1528 Steal Application Access Token
- T1555.003 Credentials from Web Browsers
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TeamPCP Backdoored LiteLLM 1.82.7/1.82.8 Install or litellm_init.pth Drop — Exploitation** (`TL-2026-5776-SPL-001`)

Detects the supply-chain entry point of the TeamPCP LiteLLM compromise (TL-2026-5776): a pip/uv/poetry install pinned to the malicious litellm 1.82.7 or 1.82.8 releases, or creation of litellm_init.pth (base64 payload that executes at every Python interpreter start) in site-packages. Behaviour-first: fires on the file drop or the explicit bad-version install, on Windows or Linux Sysmon telemetry. Covers T1195.001/T1195.002 and Python execution (T1059.006).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1195.002, T1059.006
- **Data sources:** sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), sysmon for linux (sysmon:linux), index=sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon earliest=-24h (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="sysmon:linux") ((EventCode=11 TargetFilename="*litellm_init.pth") OR (EventCode=1 (CommandLine="*litellm==1.82.7*" OR CommandLine="*litellm==1.82.8*" OR CommandLine="*litellm-1.82.7*" OR CommandLine="*litellm-1.82.8*"))) | eval indicator=if(EventCode=11, "litellm_init.pth payload dropped into a Python environment (litellm 1.82.8)", "install of backdoored litellm 1.82.7 or 1.82.8 (TeamPCP)") | stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicator values(CommandLine) as command_line values(TargetFilename) as dropped_file values(Image) as process by host, User | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen host User process indicator command_line dropped_file count
```

### Microsoft KQL

```kql
let lookback = 24h;
union
(DeviceFileEvents
| where Timestamp > ago(lookback)
| where FileName =~ 'litellm_init.pth' and ActionType in ('FileCreated','FileModified')
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal='litellm_init.pth dropped', Detail=FolderPath, Process=InitiatingProcessCommandLine),
(DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ('litellm==1.82.7','litellm==1.82.8','litellm-1.82.7','litellm-1.82.8')
| project Timestamp, DeviceName, AccountName, Signal='install of backdoored litellm', Detail=FileName, Process=ProcessCommandLine)
| sort by Timestamp desc
```

### Sigma

```yaml
title: Backdoored LiteLLM litellm_init.pth Created in Python Environment
id: 1a6e4c0d-8f32-4b57-9c1e-2d7a5b3f9e01
status: experimental
description: Detects creation of litellm_init.pth, the .pth file shipped in the malicious litellm 1.82.8 PyPI release (TeamPCP supply-chain attack) that executes a base64 payload every time the Python interpreter starts.
references:
  - https://research.jfrog.com/post/litellm-compromised-teampcp/
  - https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.006
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|endswith: 'litellm_init.pth'
  condition: selection
falsepositives:
  - None expected; litellm_init.pth is not part of any legitimate litellm release
level: critical
```

**Known false positives:**

- Security researchers or malware analysts deliberately installing litellm 1.82.7/1.82.8 in a sandbox
- Vulnerability scanners or SCA tools that download and unpack the quarantined release for analysis

**Tuning notes:** Replace index=sysmon with the index that holds your Sysmon (Windows or Linux) data. Installs driven by requirements or lock files do not show the version on the command line, so pair this rule with SCA/SBOM inventory checks for litellm 1.82.7/1.82.8. Exclude known analysis sandboxes by host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CanisterWorm npm postinstall env-compat.cjs Stealer Execution — Exploitation (locked: unlock with TL Creds)
- Mini Shai-Hulud Claude Code SessionStart Hook Persistence — Post-Exploitation (locked: unlock with TL Creds)
- Supply-Chain Stealer Credential Sweep and [indicator] Exfiltration — C2/Exfiltration (locked: unlock with TL Creds)
- Install of Compromised Namastex / CanisterWorm npm Package Versions — Exploitation (locked: unlock with TL Creds)
- LiteLLM Payload Privileged node-setup-* Pod in kube-system — Post-Exploitation/Lateral Movement (locked: unlock with TL Creds)
- Web Proxy Traffic to TeamPCP/CanisterWorm Exfiltration and Staging Endpoints — C2 (locked: unlock with TL Creds)
- LiteLLM Payload sysmon.service User-Systemd Backdoor and Stage-2 Fetch — Post-Exploitation (locked: unlock with TL Creds)
- TeamPCP / CanisterWorm C2 and Exfiltration DNS Resolutions — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- Domain: `models[.]litellm[.]cloud`
- File hash: `c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839`
- Domain: `checkmarx[.]zone`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AI Is Both Target and Tool for Threat Actors (Recorded Future / Insikt Group)](https://www.recordedfuture.com/research/ai-cyber-threat-trends-2026)
- [Inside the LiteLLM supply chain compromise (Trend Micro)](https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html)
- [Popular litellm Python package is the latest victim of TeamPCP's ongoing supply chain attack (JFrog)](https://research.jfrog.com/post/litellm-compromised-teampcp/)
- [Popular LiteLLM PyPI package compromised in TeamPCP supply chain attack (BleepingComputer)](https://bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack)
- [Namastex npm packages compromised: CanisterWorm (Socket)](https://socket.dev/blog/namastex-npm-packages-compromised-canisterworm)
- [Shai-Hulud 2.0 guidance, incl. Mini Shai-Hulud expanded campaign May 2026 (Microsoft)](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [Mini Shai Hulud: Cross-ecosystem supply chain worm targeting npm & PyPI (Expel)](https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm/)
- [More supply chain compromises: Namaste, xinference, and more (Expel)](https://expel.com/blog/more-supply-chain-compromises-namaste-xinference-and-more/)
- [Claude fraud malware campaign targeting AI developer tools (7AI)](https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools)
- [APT36 nightmare: vibeware (Bitdefender)](https://businessinsights.bitdefender.com/apt36-nightmare-vibeware)
- [GreyVibe (WithSecure)](https://www.withsecure.com/en/resources-hub/w-labs/greyvibe/)
- [Inside a multi-agent AI framework used to compromise government entities in Asia (Dream)](https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5776