Per LiteLLM's own investigation, the attackers obtained GitHub CLI OAuth tokens for an innocuously named user account in an internal LiteLLM deployment that was exposed to the public internet. The tokens were likely leaked by Claude Code, which in specific circumstances embeds them into a response body that may end up in LiteLLM's logs, where the attackers apparently retrieved them. It remains unclear how the attackers reached the internal deployment or moved laterally, though they had access to three sets of developer credentials.

With those credentials, the attackers disabled branch protections, redirected the release process to a lookalike repository, and ran a compromised GitHub workflow to sign and publish the poisoned artifacts. The payload, which per LiteLLM was likely built with the help of AI, acts as both an information stealer and a remote access tool (RAT, software that lets an attacker control a machine remotely). It harvests browser credentials, environment variables, cloud secrets for AWS, GCP and Azure, AI tool API keys, SSH private keys and more, then sends the encrypted loot to litellm[.]dev. Security firm Wiz observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking, the abuse of a victim's cloud-hosted AI resources.

LiteLLM says its enterprise customers pulling from its private repository were not affected. Anyone who installed version 1.107.0 during the compromise window should remove it immediately, rotate their credentials and sweep their systems for malware. The most recent clean version is 1.106.2.