Search — “litellm”

Mandiant/GTIG report LLMJacking intrusions in 2026 (including financial services) where actors used stolen cloud credentials, service account keys, PATs and LLM API keys to enable and abuse LLM services, generating up to $1M in charges. In one case a follow-on cluster exploited a LiteLLM /key/regenerate user ID rebind flaw (CVE-2026-40217) to elevate Virtual Keys to PROXY_ADMIN. Separately, a roundup reports Era observed the Greeter framework exploiting Flowise CVE-2024-58351 against honeypots for command execution; no victim compromises are reported for that activity. Hunt for unauthorized LLM service enablement, new access keys/service accounts, SSH key injection into instance metadata, and max_tokens=1 validation sweeps.

GTIG and Mandiant describe multiple 2026 incidents where actors (including UNC6993) used stolen IAM credentials, service account keys, GitHub PATs, session tokens and leaked LLM API keys to enable LLM services (Bedrock, Gemini API), create keys and service accounts, inject SSH keys, and resell access via LLM Mixers such as Jet Night and newapi[.]pro. Charges exceeded $100,000 in a day and reached ~$1M cumulatively at some victims, including financial services. One cluster exploited LiteLLM CVE-2026-40217 to elevate virtual keys to PROXY_ADMIN. Hunt cloud audit logs for unexpected LLM service enablement, access/service-account key creation, burn-and-rotate service account churn, project/instance SSH key metadata changes, GPU quota requests, and max_tokens=1 key-validation sweeps.

Mandiant responded to multiple 2026 incidents in which financially motivated actors (incl. UNC6993) used stolen cloud identity tokens, service account keys, GitHub PATs, leaked LLM API keys, or exposed Ollama endpoints to hijack enterprise LLM access, causing up to $1M in fraudulent charges. Actors enumerated cloud services and repos for secrets, created rogue IAM/service accounts, injected SSH keys into instance metadata, exploited a LiteLLM /key/regenerate flaw (CVE-2026-40217), enabled Bedrock/Gemini/Vertex services, and resold access via mixers like jet-night.com and newapi.pro. Hunt for unexpected LLM service enablement, max_tokens=1 validation sweeps, Bedrock InvokeModel spikes, logging config changes, and new service accounts/keys.

Attackers used a leaked, unrevoked LiteLLM Agent Platform master key to steal GitHub OAuth tokens, harvest CI secrets via throwaway-branch workflows exfiltrating to webhook.site, and repoint the release pipeline to a lookalike repo, publishing malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR on 2026-10-21. The wheel drops cook.pth/cook.py/sitecustomize.py into site-packages so any Python start runs the PRIVCOLLECT credential collector, which encrypts loot with OpenSSL in .pc_e_ staging dirs and POSTs to www.litellm.dev/healthcheck; a Unix loader polls a GitHub dead-drop for second-stage code (not confirmed executed). Microsoft observed collector activity on Windows and macOS endpoints. Hunt for Python spawning systeminfo/ipconfig/openssl, connections to litellm.dev, the startup files outside the litellm directory, and /tmp marker/lock files.

Attackers used stolen GitHub CLI OAuth tokens (suspected leaked via an exposed internal LiteLLM deployment's logs) to hijack LiteLLM's release workflow and publish 1.107.0 to PyPI, Docker Hub and GHCR. A cook.pth file runs a 'privcollect' stealer at Python startup, exfiltrating a tar.gz via HTTP POST to litellm[.]dev/healthcheck, while sitecustomize.py forks a daemon (lock /tmp/remote_code_loader.lock) that hourly fetches a C2 domain from a GitHub dead drop and executes <domain>/codepy. Stolen AWS role credentials were validated ~4.5h later with sts:GetCallerIdentity and Bedrock calls (LLMjacking). Hunt for cook.pth/sitecustomize.py in site-packages, the lock file, connections to litellm[.]dev, and CloudTrail activity from the listed IPs.