Loading malware…
Privcollect is a Python-based infostealer distributed through the compromised LiteLLM 1.107.0 release on October 21, 2026. Malicious packages for Windows, Linux, and macOS were published through PyPI, alongside compromised official container images. The attack manipulated LiteLLM’s legitimate release workflow to build and publish attacker-modified artifacts. The October operation has not been publicly attributed to a named threat actor.
The stealer executes through Python startup hooks without requiring an application to import LiteLLM. Its embedded source is concealed using Base64 encoding and zlib compression, and collection runs asynchronously in a daemon thread. Sixteen independently error-handled collection modules target developer workstations, CI/CD runners, containers, and AI gateway environments. Targets include browser credential stores, cookies and browsing histories; SSH, GPG, and TLS private keys; source-control and package-registry tokens; CI/CD secrets; Kubernetes and Docker secrets; infrastructure-tool credentials; shell histories; and authentication data for more than 20 AI development tools. Browser password recovery depends on the operating system, storage format, and available cryptographic support.
Privcollect collects AWS, Azure, and Google Cloud credentials from local stores, environment variables, and accessible instance or task metadata services. It also reads accessible Linux process environments and can validate AWS credentials using the Security Token Service. When database access prerequisites are available, it attempts to query the LiteLLM proxy database for stored upstream-provider credentials and model configurations.
Collected information and host metadata are serialized as JSON, encrypted using AES-256-CBC, and packaged with an RSA-4096-OAEP-wrapped encryption key for HTTP POST exfiltration. Uploads are retried, and successful uploads trigger an attempt to create a marker suppressing subsequent collection. A separate Unix-oriented loader distributed alongside the stealer could retrieve and execute additional Python code through a GitHub-hosted dead drop; second-stage execution was not confirmed.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
« Le workflow de release a été redirigé vers un dépôt malveillant contrefait. Le 21 octobre 2026, le package compromis version 1.107.0 et une image container malveillante ont été publiés »
Supply chain compromise: malicious release via hijacked CI/CD release workflow
« Sur les systèmes Unix, le malware pouvait potentiellement récupérer et exécuter du code Python additionnel (aucune activité de ce type détectée). »
Python executes both hook types at interpreter start, so the stealer ran on any Python process in the environment, pip included, whether or not the code ever imported LiteLLM.
Python executes both hook types at interpreter start, so the stealer ran on any Python process in the environment, pip included, whether or not the code ever imported LiteLLM.
Both Python files embed Base64-encoded, zlib-compressed source.
Both Python files embed Base64-encoded, zlib-compressed source. Static decoding recovered nearly identical collectors, approximately 61 KB each.
« a extrait un token OAuth GitHub CLI de niveau owner, donnant accès à l’ensemble des dépôts » ; « utilisé des workflows GitHub légitimes pour collecter des tokens supplémentaires »
« Navigateurs : secrets et cookies de Chrome, Firefox, Edge, Safari »
« clés API OpenAI, Anthropic, Cohere et autres fournisseurs LLM (variables d’environnement et fichiers de config) » ; « historiques shell »
« Systèmes : clés SSH privées, clés GPG, historiques shell »
AWS IMDSv2 (v1 fallback), ECS task creds, GCP SA tokens, Azure IMDS
Chromium-family login, cookie and web-data DBs (passwords decrypted in place on Linux/Windows); Firefox logins.json and key4.db
ipconfig, route, arp, and netstat were launched by the same Python process.
systeminfo was launched by Python in an observed Windows sequence.
Collects selected local histories, environment variables, and configuration.
« T1041 — Exfiltration Over C2 Channel (Exfiltration) » ; « L’exploitation des credentials volés a débuté 4h30 après l’exfiltration depuis deux adresses IP. »
Exfiltration hxxp://www.litellm[.]dev/healthcheck (plain HTTP POST)
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.