Credential Theft

On 21 October 2026, malicious LiteLLM 1.107.0 artifacts hit PyPI, Docker Hub and GHCR. The payload ran at Python startup via a .pth file — no import needed — and exfiltrated cloud, AI, SSH and GPG credentials to a look-alike domain. What happened, the IOCs, and exactly what a security team should do now.

Check Point reports a fast-growing phishing campaign that abuses legitimate calendar features — malicious .ics attachments and fake Microsoft Teams invites — to steal Microsoft 365 credentials, with more than 302,386 unique phishing emails hitting over 40,000 organizations and volume climbing from a few thousand a month in April to more than 740,000 in the first two weeks of October. This is not a flaw in Outlook, Teams or the .ics format; it is the abuse of trusted calendar behaviour. A third-party, figures-attributed read of what the campaign is, why calendar invites bypass normal phishing instincts, and the defensive playbook for security leaders. Every number is attributed to Check Point.

OpenCode (Anomaly Innovations) notified a subset of users on 17 Oct 2026 that an intruder reached a legacy system and may have exposed stored OpenAI, Anthropic and Google API keys; developers report thousands in fraudulent inference spend. A calm, third-party read of what is confirmed, what is not, and exactly what to do if you use any bring-your-own-key AI tool. PlayCISO is not affiliated with OpenCode; every figure here is attributed.

A compromised release of the tensorlake npm SDK (version 0.5.144) carries a Shai-Hulud / ChainDrop-family worm. A preinstall hook runs setup.mjs, skips CI so it lands on developer laptops, pulls the Bun runtime and executes an obfuscated payload that steals GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, browser logins and AI-tool configs, then republishes itself into every package the stolen npm token can reach. The twist: a “gh-token-monitor” service wipes the home directory if you revoke the stolen GitHub token. Safe version to pin: 0.5.143. Developing story — what’s confirmed, what isn’t, and the order of operations for cleanup.

A malicious @subql/common on npm stole .npmrc, .env, AWS, SSH and GitHub keys — part of ChainDrop, a Shai-Hulud-family worm. The defender’s playbook.

A defensive brief on a fast-rising risk class: malicious or compromised LLM routers and MCP gateways that inject unintended tool calls, steal credentials in transit, and pivot across hosts. What the attack looks like, why it scales, and the controls that actually contain it.

Attackers are mass-exploiting CVE-2026-0768, a CVSS 9.8 unauthenticated RCE in the Langflow AI app builder, to run code as root and harvest OpenAI API keys and cloud secrets. What the flaw is, why AI gateways are the target, and what to do today.

CISA added LiteLLM CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on Sep 3, 2026 — an unauthenticated attacker can establish an authenticated MCP session against the popular AI gateway. Why the gateway is the prize, and how to respond.

Microsoft detailed a coordinated campaign (Aug 2026) hitting exposed AI infrastructure — LiteLLM, RAGFlow, Kestra — to steal every model-provider API key and then mine crypto on the box. The CVEs, the credential-harvesting playbook, and how to lock your AI control points down.