TeamPCP’s Trivy Attack Hit 2,500 Organizations; AI Tool Backdoors Are Claimed

A compromised build of Aqua Security’s Trivy scanner was used in a supply-chain attack that harvested credentials from more than 2,500 organizations through LiteLLM. The exposed material included cloud, repository, Kubernetes and AI-provider access, and some tested keys still worked nearly five months later. Morphisec now alleges that malware tied to the same actor can persist by altering AI coding-assistant configuration files after the original package is removed.

A trusted scanner became the entry point

The attack began on March 24, 2026, when TeamPCP compromised a build of the open-source Trivy vulnerability scanner. LiteLLM automatically downloaded that package without checking its identity, allowing the poisoned tool to gain server-administrator privileges and install an information stealer. LiteLLM itself was not directly compromised.

The immediate risk was reusable access, not simply a data dump. The reported affected organizations included Cisco, Samsung, Salesforce, Amazon Web Services, Airbus U.S. Space & Defense, Thales Group, Deutsche Bahn, Munich Re and the London Stock Exchange Group. Independent researcher Kevin Beaumont tested some compromised keys and found them valid nearly five months after the attack.

The credentials reportedly taken

• Cloud keys, SSH keys and Kubernetes tokens.
• Environment variables, repository tokens and package-publishing tokens.
• AI-provider keys.

The alleged second stage changes the cleanup target

Morphisec attributes its broader Hades campaign account to a threat actor Google tracks as UNC6780 and that calls itself TeamPCP. It says the campaign has targeted developer credentials since at least March 2026 and that its latest variant uses a Python .pth startup hook and the Bun runtime to execute a payload.

Its more unusual allegation concerns the developer’s AI layer. Morphisec says Hades inserts comments meant to persuade AI security reviewers to deem malicious code safe. It also says the malware searches configuration files for 14 AI coding tools, including Claude Code, Cursor, GitHub Copilot, Google Gemini and Codex, then adds instructions and a startup hook that run when a developer reopens a project.

If that technique works as described, removing the infected package would not by itself remove the backdoor: Morphisec says persistence sits in the assistant configuration. That differs from the documented credential problem, where access can remain useful until affected keys are changed.

The exposure count is large; the persistence claim is not settled

CloudSEK put the LiteLLM-related impact at 434,000 compromised CI/CD pipelines. Hudson Rock released a 153 GB archive after examining a 195 TB file of exfiltrated material, and both firms offered domain-lookup tools for organizations checking exposure.

Morphisec pairs its Hades account with a pitch for runtime-prevention products, and the AI-assistant claims have not been independently corroborated. The credential exposure warrants action; the AI-tool backdoor scenario remains a serious allegation rather than an established feature of the LiteLLM attack.