#credential-theft

Cloud security firm Wiz says at least nine platforms that developers use to build and host AI apps disclosed security incidents in October, among them Fireworks AI, Lightning AI, OpenCode, Railway, Warp and, on October 30, Northflank. It later added Brev (NVIDIA), Trigger.dev and Chainstack. Wiz says no single vulnerability links them, but every public report describes attackers hunting stored environment variables, especially keys that unlock AI services. Zeabur says it will shut down after its incident.

Wiz traced two stolen enterprise keys: each was first tested with a single call, then flooded with Amazon Bedrock requests, about 2.5 million calls in all and likely over $100,000 in usage at list price, with traffic resembling resold coding-agent use. It links the keys to an LLM-resale operation.

Northflank told customers to assume every environment variable was decrypted and to rotate all secrets; users reported their AI keys being abused. It says the attack vector was contained within an hour, that it patched the Linux flaw CVE-2026-98432 across its fleet, and that a root-cause report will follow.

Cisco Talos describes VOLTA, a self-deleting Windows infostealer that, after taking browser passwords, cookies, payment cards, crypto wallet phrases, chat and gaming sessions, and cloud keys, builds a profile of the victim and sends it to a large language model through OpenRouter. The prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment," with sections on what the victim is worth and how weak their security habits are.

Talos says the malware uses stolen sessions to enrich the profile, for example by searching the victim's Gmail for receipts to confirm a home address and pulling food-delivery order history. Its default model is Anthropic's Claude Opus 4.6; if a response contains refusal phrases such as "I can't," it falls back to Moonshot's Kimi K2 and then Google's Gemini 2.5 Flash, which Talos reads as the author expecting guardrails.

Talos's point: the AI is not writing malware here but doing the criminal's triage, turning a raw credential dump into a prioritized dossier.

Version 1.107.0 of LiteLLM, a popular open-source Python gateway for calling AI models, was published to PyPI and Docker registries with malware on October 21, according to SafeDep and BleepingComputer. LiteLLM confirmed the compromise and says the release pipeline was hijacked; SafeDep says LiteLLM believes the attacker took three developers' GitHub CLI credentials from the logs of an internet-exposed internal deployment.

All seven wheels for Linux, macOS and Windows added three files that run whenever Python starts, even if litellm is never imported. One steals SSH keys, cloud and CI/CD credentials, AI tool tokens, browser passwords and stored model-provider keys; another checks in hourly and downloads and runs more code. The PyPI release was live from 11:39 to 13:23 UTC; Docker Hub and GHCR tags pointed to bad images for a couple of hours. Versions 1.106.2 and the 1.107.0 release candidates are clean.

BleepingComputer says affected systems should be isolated and rebuilt and all exposed secrets rotated, and warns that running Python or pip to investigate also triggers the malware.