The LiteLLM Supply Chain Attack Hit 2,500+ Organizations — Many Still Haven't Rotated Their Secrets

In March 2026, the threat group TeamPCP executed a cascading supply chain attack that started with a security scanner and ended with the compromise of LiteLLM, one of the most popular open-source AI proxy packages in the Python ecosystem. The breach potentially exposed 2,500+ organizations, compromised 434,000+ CI/CD pipelines, and exfiltrated 433,909 files of credentials in a 153 GB archive . Here is what happened, who was affected, and why the danger is far from over.

How TeamPCP Executed the Five-Day Cascade

TeamPCP (also tracked as PCPcat, ShellForce, and DeadCatx3) is a financially motivated cybercriminal group that has been active since mid-2025 . Their March 2026 campaign was notable for its cascading architecture: credentials stolen from one victim's CI/CD pipeline became the access vector for the next target . The cascade unfolded over five days:

Day 1: Trivy (March 19)

TeamPCP gained initial access to Aqua Security's infrastructure by exploiting a pull_request_target workflow misconfiguration — a "PwnRequest" flaw . They intercepted a newly rotated personal access token for the aqua-bot service account and force-pushed version tags to point to malicious commits. Seventy-six of 77 trivy-action tags and all 7 setup-trivy tags were hijacked . This first compromise is tracked as CVE-2026-33634 (CVSS 9.8 Critical) .

Day 2: KICS (March 23)

Using tokens stolen from Trivy victims, TeamPCP authenticated as Checkmarx's cx-plugins-releases service account and pushed malicious KICS releases .

Day 3: LiteLLM (March 24)

LiteLLM's build pipeline automatically installed the compromised Trivy scanner, giving the malware read access to the runner environment. TeamPCP stole LiteLLM's PyPI publishing tokens and published two malicious releases — versions 1.82.7 and 1.82.8 — to PyPI . The malicious packages were live for only approximately 40 minutes before discovery .

The Payload

The LiteLLM malware deployed a three-stage payload :

• A credential harvester targeting 50+ categories of secrets
• A Kubernetes lateral movement toolkit that escalated to root and deployed privileged pods
• A persistent backdoor for remote code execution

The malware used .pth file injection to auto-execute on every Python interpreter startup, requiring no explicit import — making it especially difficult to detect . On compromised runners, the payload — tracked by Google as SANDCLOCK — swept SSH keys, AWS/GCP/Azure credentials, Kubernetes service account tokens, and database passwords .

Organizations Affected

Source	Figure
CloudSEK (reconstructed exposure)	2,500+ organizations potentially exposed
CloudSEK (CI/CD pipelines)	~434,000 pipeline runs touched
Hudson Rock (attributed CI runner dumps)	118,829 dumps from 2,488 corporate domains
Archive size	153 GB, 433,909 files

Named victims identified by multiple threat intelligence firms include :

Technology: Nvidia, AWS, Samsung, Salesforce, Cisco, ServiceNow, Microsoft, HP, NGINX, Zscaler, TomTom
Enterprise: Siemens, Volkswagen, FedEx, S&P Global, John Deere, Epic Games, Deloitte, Accenture Federal Services
Telecom/Media: Orange, BT Group, SiriusXM/AdsWizz
Other: London Stock Exchange Group, Regeneron Pharmaceuticals, Deutsche Bahn

The European Commission was also breached via the initial Trivy compromise, resulting in the exfiltration of AWS management credentials and ~340 GB of uncompressed data stolen, affecting 42 internal clients and 29 additional EU entities .

Scale of Credential Exposure

The stolen data types include :

• Cloud IAM keys (AWS, GCP, Azure)
• SSH keys and Kubernetes secrets
• Database passwords and Salesforce client secrets
• Slack signing secrets and environment variables
• AI provider API keys (OpenAI, Anthropic, AWS Bedrock, Google Vertex AI)

The FBI issued a FLASH advisory on July 2, 2026 warning that organizations hit by the campaign should treat exfiltrated data and credentials as a persistent risk because affiliated actors are likely to weaponize them .

The Ongoing Risk from Unrotated Secrets

Despite the severity of the breach, the risk is far from contained for several reasons:

The Archive Has Not Yet Leaked

Hudson Rock, which obtained and analyzed the archive, reports that the 153 GB dataset is not circulating widely yet — calling it "a critical window of opportunity" for organizations to rotate keys before it eventually leaks .

Many Organizations Haven't Rotated

Security researcher Kevin Beaumont tested credentials from one organization that claimed to have rotated everything. His finding: "Almost every one worked" .

Unidentifiable Credentials

A large share of the dumped files contain database passwords, API keys, and cloud credentials without any company email, custom domain, or internal server name to identify the owning organization. Those organizations cannot know they are affected .

Exposure vs. Confirmed Compromise

The 2,500+ figure reflects reconstructed exposure, not confirmed compromise for every organization. CloudSEK stresses that every listed organization should independently verify . But the dataset is now in the hands of multiple threat-intelligence firms, and the natural cycle of a breach means wider circulation is expected.

Key Takeaways for Organizations

Any organization that:

• Ran LiteLLM versions 1.82.7 or 1.82.8
• Had CI/CD pipelines that consumed those versions
• Used the compromised Trivy scanner between March 19-24, 2026

...should treat all secrets accessible to that environment as compromised and rotate them immediately, even if no obvious breach has been detected . The FBI's FLASH advisory reinforces this: treat exfiltrated credentials as a persistent risk because affiliated actors are likely to weaponize them .

TeamPCP demonstrated that one unrevoked token, three tools deep can turn a single credential leak into ecosystem-wide exposure. The LiteLLM attack is a stark reminder that in modern software supply chains, the tool you trust to find vulnerabilities can itself become the vulnerability.

Key Metric	Value
Malicious package exposure window	~40 minutes
Potentially exposed organizations	2,500+
CI/CD pipelines exposed	~434,000
CI runner dumps attributed (Hudson Rock)	118,829
Archive size	153 GB
Total files	433,909
Attributed corporate domains (Hudson Rock)	2,488
Known victims named	25+ major enterprises