Superpower Daily
Salesforce Uses SageMaker Placement Controls to Meet 2-AZ Agent...TeamPCP’s Trivy Attack Hit 2,500 Organizations; AI Tool Backdoo...Nasuni Buys DryvIQ, Adds Governance Across 40-Plus Data Reposit...JAMA Paper Says Autonomous AI Could Surpass Physicians and AI-A...Amap Releases ABot-Recon, a 12-Frame 3D Mapper for 10,000-Frame...Databricks Files $5B Equity Offering With Nearly All of It Alre...Salesforce Uses SageMaker Placement Controls to Meet 2-AZ Agent...TeamPCP’s Trivy Attack Hit 2,500 Organizations; AI Tool Backdoo...Nasuni Buys DryvIQ, Adds Governance Across 40-Plus Data Reposit...JAMA Paper Says Autonomous AI Could Surpass Physicians and AI-A...Amap Releases ABot-Recon, a 12-Frame 3D Mapper for 10,000-Frame...Databricks Files $5B Equity Offering With Nearly All of It Alre...
Toolspublished

TeamPCP’s Trivy Attack Hit 2,500 Organizations; AI Tool Backdoors Are Claimed

The LiteLLM-linked exposure shows how a poisoned dependency can yield reusable developer access. Claims of persistence in AI coding-tool settings would make cleanup harder, but they remain uncorroborated.

By 3 min read
TeamPCP’s Trivy Attack Hit 2,500 Organizations; AI Tool Backdoors Are Claimed
Sign in to save and react

Listen to this story

The audio brief

About 1:39
0:001:39
Read transcript
Some compromised keys from the TeamPCP attack were still usable nearly five months later, turning a March supply-chain incident into a continuing access problem. The entry point was a poisoned build of Trivy, an open-source security scanner. LiteLLM downloaded it without verifying the package’s identity, and the malicious build gained administrator privileges before installing an information stealer. LiteLLM itself was not compromised. Researchers say the stolen material covered cloud credentials, SSH keys, Kubernetes tokens, repository access, package-publishing credentials, and keys for AI providers. More than 2,500 organizations were reportedly affected, while CloudSEK estimated roughly 434,000 compromised CI/CD pipelines. Hudson Rock also released a 153-gigabyte archive drawn from exfiltrated data. Kevin Beaumont’s testing found that some exposed keys remained valid almost five months after the March 24, 2026 attack, which makes rotation and revocation more urgent than simply deleting stolen files. There is a second, separate claim. Morphisec says a Hades variant can modify configuration for 14 AI coding assistants, including Claude Code, Cursor, GitHub Copilot, Google Gemini, and Codex. The alleged changes include instructions and a startup hook, potentially surviving removal of the original package. But that persistence technique has not been independently corroborated, and it should not be confused with the documented credential theft. The key thing to watch is whether the AI-assistant backdoor claim is confirmed; the exposed credentials already represent an established, reusable access risk.

Story brief

3 key points

The incident’s most actionable consequence is durable credential exposure: researchers reported access to cloud, Kubernetes, repositories, package registries, and AI providers across more than 2,500 organizations, with some keys still usable almost five months later. A separate Morphisec report alleges Hades can modify configuration for 14 AI coding assistants, including Claude Code, Cursor, Copilot, Gemini, and...

  1. 01

    Affected credentials reportedly included cloud, SSH, Kubernetes, repository, package-publishing, and AI-provider access.

  2. 02

    LiteLLM reportedly downloaded the poisoned Trivy build without verifying package identity; LiteLLM itself was not compromised.

  3. 03

    CloudSEK estimated 434,000 compromised CI/CD pipelines; Hudson Rock released a 153 GB archive from exfiltrated data.

A compromised build of Aqua Security’s Trivy scanner was used in a supply-chain attack that harvested credentials from more than 2,500 organizations through LiteLLM. The exposed material included cloud, repository, Kubernetes and AI-provider access, and some tested keys still worked nearly five months later. Morphisec now alleges that malware tied to the same actor can persist by altering AI coding-assistant configuration files after the original package is removed.

A trusted scanner became the entry point

The attack began on March 24, 2026, when TeamPCP compromised a build of the open-source Trivy vulnerability scanner. LiteLLM automatically downloaded that package without checking its identity, allowing the poisoned tool to gain server-administrator privileges and install an information stealer. LiteLLM itself was not directly compromised.

The immediate risk was reusable access, not simply a data dump. The reported affected organizations included Cisco, Samsung, Salesforce, Amazon Web Services, Airbus U.S. Space & Defense, Thales Group, Deutsche Bahn, Munich Re and the London Stock Exchange Group. Independent researcher Kevin Beaumont tested some compromised keys and found them valid nearly five months after the attack.

The credentials reportedly taken

  • Cloud keys, SSH keys and Kubernetes tokens.
  • Environment variables, repository tokens and package-publishing tokens.
  • AI-provider keys.

The alleged second stage changes the cleanup target

Morphisec attributes its broader Hades campaign account to a threat actor Google tracks as UNC6780 and that calls itself TeamPCP. It says the campaign has targeted developer credentials since at least March 2026 and that its latest variant uses a Python .pth startup hook and the Bun runtime to execute a payload.

Its more unusual allegation concerns the developer’s AI layer. Morphisec says Hades inserts comments meant to persuade AI security reviewers to deem malicious code safe. It also says the malware searches configuration files for 14 AI coding tools, including Claude Code, Cursor, GitHub Copilot, Google Gemini and Codex, then adds instructions and a startup hook that run when a developer reopens a project.

If that technique works as described, removing the infected package would not by itself remove the backdoor: Morphisec says persistence sits in the assistant configuration. That differs from the documented credential problem, where access can remain useful until affected keys are changed.

The exposure count is large; the persistence claim is not settled

CloudSEK put the LiteLLM-related impact at 434,000 compromised CI/CD pipelines. Hudson Rock released a 153 GB archive after examining a 195 TB file of exfiltrated material, and both firms offered domain-lookup tools for organizations checking exposure.

Morphisec pairs its Hades account with a pitch for runtime-prevention products, and the AI-assistant claims have not been independently corroborated. The credential exposure warrants action; the AI-tool backdoor scenario remains a serious allegation rather than an established feature of the LiteLLM attack.

Editorial analysis

Our Read

Our view: The important operational distinction is between exposure and persistence. The LiteLLM incident gives organizations a concrete reason to find and rotate secrets; Beaumont’s test suggests that task was not complete everywhere months later. Morphisec’s AI-configuration account, if independently validated, would widen response from packages and keys to developer-tool settings. The next evidence worth watching is technical confirmation of that persistence method, plus whether organizations identified by CloudSEK and Hudson Rock close the remaining valid-key window and review affected environments.

Citation desk / original work

Cite this

Permanent attributionView citation
Finding 01

Our view: The important operational distinction is between exposure and persistence.

/posts/teampcp-s-trivy-attack-hit-2-500-organizations-ai-tool-backdoors-are-claimed#finding-1

Sources

  1. techradar.comMassive supply-chain attack sees terabytes of data belonging to some of the world’s biggest and most sensitive organizations leaked online
  2. morphisec.comWhen Your AI Coding Assistant Becomes the Attack: The Hades Supply Chain Campaign

Related coverage

Continue reading