LiteLLM Supply Chain Hack Hit 2,488 Firms; Stolen Keys Still Work Five Months On

Published: August 14, 2026 — TechTimes

Security researcher Kevin Beaumont got a call last week from a major US technology company that insisted it had nothing to worry about: all the credentials stolen in March’s LiteLLM supply chain attack had been rotated. So Beaumont checked. “I tried them all. Almost every one worked,” he wrote on Mastodon on August 13, 2026. “Submitted report. One of the biggest US techcos.” He confirmed this on his Mastodon timeline after reviewing the company’s responsible disclosure policy, which explicitly permitted credential testing.

That disclosure came the same day Hudson Rock, an Israeli cybersecurity intelligence firm, revealed it had obtained and fully analyzed a 153 GB RAR archive containing 433,909 files stolen during the March 2026 LiteLLM supply chain attack — the largest breach of AI infrastructure recorded in 2026. Of those files, the firm attributed 118,829 CI/CD pipeline runner dumps to 2,488 corporate domains, including NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, Cisco, Deloitte, and Siemens, among dozens of other global enterprises. The archive has not yet been widely leaked. That window, Hudson Rock warned, will not remain open indefinitely.

The critical information for enterprise security teams is not the size of the archive. It is the finding that Beaumont independently confirmed: for many of the organizations represented in the dataset, the stolen credentials are still live. The “40-minute window” that characterized early reporting on this breach — the time malicious packages were available on PyPI before being quarantined — describes the exposure period for the package registry. It does not describe the damage window. That window runs from March 24, 2026, when the malicious packages were first installed in corporate pipelines, until the day every affected organization rotates every credential those pipelines held. Five months later, that day has not arrived for a significant share of the 2,488 named domains.

Why the Attack Window Did Not Close When PyPI Did

LiteLLM is an open-source proxy library with 3.4 million daily downloads. It sits between an engineering team’s code and every large language model provider — OpenAI, Anthropic, Google Gemini, and others — acting as a unified API gateway. A compromised LiteLLM installation by design exposes every LLM provider key in an organization.

The attack did not begin with LiteLLM. On March 19, 2026, threat group TeamPCP (Google tracks as UNC6780) exploited an incompletely revoked credential from a prior breach to force-push malicious code over 76 of 77 version tags in the Trivy vulnerability scanner’s GitHub Actions workflow. LiteLLM’s build pipeline consumed Trivy via mutable version tags rather than pinned commits (Trivy advisory GHSA-69fq-xp46-6x23), allowing harvest of PyPI publishing tokens.

On March 24, 2026, TeamPCP published backdoored LiteLLM versions 1.82.7 and 1.82.8 to PyPI. Version 1.82.8 included litellm_init.pth — a Python startup hook processed by site module at interpreter initialization. --ignore-scripts does not apply to .pth files.

PyPI quarantined packages in ~40 minutes. Payload harvested environment variables, cloud configs, IAM tokens from metadata service, Kubernetes secrets, SSH keys, and AI provider API keys. Second stage deployed privileged Alpine pods into kube-system. Third stage installed sysmon.py as systemd service. Where exfiltration failed, malware created public GitHub repos in victim accounts and uploaded stolen data as release assets.

Alon Gal, Hudson Rock co-founder and CTO: “A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested.”

Credential longevity

FBI FLASH advisory FLASH-20260702-01 (July 2, 2026) warned TeamPCP-affiliated actors would weaponize harvested credentials long after intrusion, flagging LiteLLM alongside Trivy, Checkmarx KICS, and Telnyx Python SDK.

Sophos documented TeamPCP partnership with ransomware affiliate VECT (March 2026) converting credentials into Anubis ransomware (91 victims by July 2026). PCPJack emerged mid-2026 to exploit the same stolen credential base.

Remediation guidance from article

• Audit for LiteLLM 1.82.7 and 1.82.8 (last safe before compromise: 1.82.6; 1.83.0 confirmed clean)
• Check for litellm_init.pth and sysmon.service
• Rotate all cloud IAM keys, AI provider API keys, K8s tokens, SSH keys, GitHub PATs, SaaS secrets accessible to affected environments
• Hudson Rock Cavalier and CloudSEK AI supply chain checker available for domain lookup