TeamPCP Trojanizes LiteLLM Python Packages to Steal Credentials
Summary
Malicious LiteLLM versions 1.82.7 and 1.82.8 used Python startup execution and persistence to collect credentials and other sensitive data, then exfiltrate it. PyPI quarantined the packages; LiteLLM published a security update.
Key points
- Malicious LiteLLM versions 1.82.7 and 1.82.8 were published on March 24, 2026, and quarantined by PyPI at 11:25 UTC.
- Version 1.82.7 runs a payload when LiteLLM proxy functionality is invoked; 1.82.8 adds a malicious .pth file that executes code whenever Python starts.
- The payload collects environment variables, API tokens, SSH keys, cloud and Kubernetes credentials, CI/CD secrets, Docker and database credentials, and cryptocurrency wallets.
- Stolen data is encrypted with AES-256, with the key encrypted using an embedded RSA public key, and sent to attacker-controlled domains checkmarx[.]zone or models[.]litellm[.]cloud.
- The campaign reuses persistence methods observed in the KICS operation and uses checkmarx[.]zone/raw to call out to a persistent Python script.
- Wiz identified an exposed API token from the earlier Trivy incident as the root cause; LiteLLM published an actively maintained security update.
Article Details
- Attack Vectors
- Malicious LiteLLM Python package versions 1.82.7 and 1.82.8 were published to PyPI. The article says an exposed API token from the prior Trivy incident was identified in a PyPI advisory as the root cause.
- Version 1.82.7 drops a double-base64-encoded payload to disk and runs it when litellm –proxy is run or litellm.proxy.proxy_server is imported.
- Version 1.82.8 also installs a malicious litellm_init.pth file, which runs code during Python interpreter initialization, including when LiteLLM is not explicitly imported.
- The payload collects host data including environment variables, API keys, tokens, SSH keys, cloud credentials, Kubernetes and Docker configurations, CI/CD secrets, database credentials, and cryptocurrency wallets. It encrypts the data and exfiltrates it to attacker-controlled domains.
- The script uses basic and Kubernetes-based persistence mechanisms and calls out to checkmarx.zone/raw for its persistent Python script.
- Defensive Notes
- Wiz advised customers to monitor its Threat Center advisory for ongoing guidance, pre-built queries, and relevant detections.
- The article notes that LiteLLM published an official, actively maintained Security Update.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Attacker-controlled domain used for data exfiltration by LiteLLM version 1.82.7. |
| DOMAIN | models[.]litellm[.]cloud | Attacker-controlled domain used for data exfiltration by LiteLLM version 1.82.8. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects data from the host, including environment variables, keys, credentials, and configuration files.T1027 · Obfuscated Files or InformationThe payload is double base64 encoded before execution.T1059.006 · PythonThe malicious package executes its payload through Python, including via a .pth file during interpreter initialization.T1552.001 · Credentials In FilesThe payload collects credentials from files and configurations, including SSH keys and cloud credentials.