Malware
privcollect
- First Reported
- Oct 21, 2026
- Latest Reported
- Oct 21, 2026
Reported Context (2)
- The embedded credential stealer, internally named privcollect, harvests sensitive data across 16 modules targeting browsers, cloud providers, and AI services. It extracts: Trojanized LiteLLM 1.107.0 Package Steals Credentials Through Python Startup Hooks
- The decoded payload, which uses the identifier privcollect, enables 16 collection modules. Each module runs behind its own error handler, allowing collection to continue when another target is unavailable. Malicious LiteLLM 1.107.0 Release Steals Credentials Through Python Startup Hooks
MITRE ATT&CK (20)
Vendors (3)
Products (5)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.