The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials

In March 2026, a threat actor group called TeamPCP compromised the CI/CD pipeline of Trivy, one of the most widely used open source vulnerability scanners in the industry. This access was used to steal the publishing credentials of LiteLLM, another very popular open source AI proxy gateway. Five months later the consequences of that single intrusion are still surfacing.

In August 2026, a 153 GB dataset of exfiltrated credentials tied to this leak appeared, mapped to more than 2,000 organisations around the world, resulting in one of the largest AI related supply chain incidents of the year. 

What happened: time line of the attack

The attack did not begin with a direct targeting of LiteLLM itself or their users. This sits within the larger campaign conducted by TeamPCP linked to their attack on Trivy. Trivy, an open source vulnerability scanner from Aqua Security was breached by TeamPCP in March 2026. Despite mitigation measures taken, Aqua Securities claims the malicious actor retained access after an incomplete credential rotation.

These credentials gave access to legitimate PyPI publishing capabilities for LiteLLM, and two trojanized versions of LiteLLM Python packages (1.82.7 and 1.82.8) were published. As LiteLLM sits at the centre of many organisations’ AI infrastructure, routing traffic to providers like OpenAI, Anthropic and Google Gemini, the malicious versions were pulled into production and CI/CDs quickly and quietly. 

Like any other Trojan malware, once executed it worked to harvest credentials, environmental variables (as used later) and cloud configuration files, etc, from the systems it ran on, and then exfiltrated them to the attacker controlled infrastructure. 

This exfiltrated data, retrieved by independent analysts confirmed at least 153 GB worth of data impacting over 2000 organisations, including Amazon, NVIDIA, Samsung, among many others. Our analysis of the dataset suggests that the exact scope and severity of the content exposed will differ by victim. 

Who is TeamPCP

TeamPCP, also known as CypherForce, Shellforce, and Altered Spider among others, is a financially motivated actor that has been publicly observed since September 2025. For a group that has been active for less than a year, they have already drawn the attention of global law enforcement, such as the FBI who have issued a FLASH advisory describing the group’s use of trojanised developer tool updates. 

They primarily target financial services and technology companies focusing on North America and the Gulf region. 

What are TeamPCP’s TTPs:

• Erster Zugang: stealing credentials from developer machines, slipping malicious commits into codebases via these compromised service attacks, and taking over abandoned or expired maintainer recovery emails. 
• Ausführung: hides malicious code inside trusted CI/CD workflows and open-source package releases, and abuses a lesser-known Python mechanism (startup hook files) that runs code automatically whenever Python itself starts.
• Persistenz: Backdoors are built directly into what look like routine package updates, and the group has created hidden repositories inside victims’ own GitHub organizations to quietly store stolen data.
• Umgehung der Verteidigung: The malware is built to keep everything working normally so nothing looks broken, deletes its own traces after running, encrypts stolen data before sending it out, and has even been observed hiding payloads inside ordinary-looking audio files.
• Zugang zu Anmeldeinformationen: Rather than reading secrets from disk (where CI providers typically mask them), the malware reads credentials directly out of a running process’s memory, sidestepping those protections, and captures a wide range of credential types: cloud access tokens, Kubernetes service credentials, SSH keys, and cryptocurrency wallet data.
• Lateral movement: A self-propagating component spreads automatically across open-source package ecosystems, scans for exposed container services, and moves across Kubernetes clusters once inside a network.
• Exfiltration: Stolen data is routed to attacker controlled servers disguised to resemble legitimate vendor domains, with hidden GitHub repositories used as a fallback channel if the primary route is blocked.
• Auswirkungen: Beyond credential theft, the group’s playbook extends to ransomware deployment and extortion via public leak sites, with reported ties to other established ransomware and extortion operations.

What was exposed

CybelAngel obtained and reviewed the exfiltrated dataset directly. According to our analysis, the dumps were raw, unencrypted environment captures taken mid-execution from live CI/CD runners and production systems, meaning the credentials recovered were active and fully privileged at the time of collection, not stale or expired test values. Our review breaks the exposure down into several categories:

• Cloud infrastructure credentials: Large volumes of AWS IAM access keys and secret keys were found exposed in plain text, sitting directly in runner environment variables.
• CI/CD and version control secrets: GitLab Runner dumps exposed committer email addresses linked to identifiable organizations, along with internal configuration paths, runner metadata, and active access tokens.
• Third-party SaaS and tooling credentials: Internal package registry logins, CI deploy tokens, and API keys for third-party security and DevOps tools were also present, alongside client secrets for identity and business platforms such as Microsoft, Salesforce, Slack, and Azure.
• AI provider and gateway credentials: Because LiteLLM sits at the center of AI traffic routing for many organizations, affected environments disproportionately exposed API keys for AI providers, including OpenAI, Anthropic, Azure, Google Gemini, Fireworks, Groq, and Cerebras.
• Database and internal infrastructure secrets: A subset of files contained active database passwords and internal server or cluster identifiers, consistent with the malware’s documented attempts at lateral movement across Kubernetes environments after initial credential theft.

Why this matters beyond LiteLLM users

The most important lesson from this incident isn’t really about LiteLLM. It’s about the pattern: even a security tool, something teams install specifically to reduce risk, can become the initial access point for one of the year’s largest credential exposure events. 

It also highlights a gap that’s easy to overlook: AI gateways and routing layers are becoming as security-critical as cloud IAM, but they’re rarely monitored with the same rigor. Most organizations have mature processes for rotating and auditing cloud credentials. Far fewer have equivalent processes for the API keys sitting inside their AI infrastructure. And because supply chain compromises like this one ripple through vendors and contractors, an organization doesn’t need to use LiteLLM directly to be affected by it.

How CybelAngel is tracking this

CybelAngel obtained and analyzed the exfiltrated dataset on August 12, 2026. Using our scanning capabilities, our analyst team was able to isolate the records within the dataset relevant to our client base and report the specific exposure directly to each organization concerned.  This kind of incident illustrates why continuous monitoring of exposed data, beyond a single point-in-time scan, matters.

Organizations that want to know whether their credentials are part of incidents like this one, rather than finding out after the fact, should talk to us about CybelAngel’s exposure monitoring capabilities.