Wiz: stolen credentials from LiteLLM supply chain incident already abused for LLMJacking from two tracked IPs
wunderwuzzi23 · x · 2026-10-22
Wiz continues updating its tracking of the LiteLLM supply chain incident and now reports active abuse of stolen credentials, initially tied to LLMJacking, from IPs 168.100.8[.]57 and 165.227.201[.]8. Security researcher wunderwuzzi links his prior 'LLM Heist' research explaining why LiteLLM is a high-value target: as a unified AI gateway holding real provider keys, compromise enables data/PII theft, unauthorized inference on the victim's account, response/tool-call injection into AI clients, and live-chat harvesting for model distillation. The TTPs and detection guidance apply to AI gateway products generally.
More from Infra
- Redditor converts missing models to OpenVINO IR and takes requests — Sudden_Topic5154 · 2026-10-22
- Meta plans up to $145B in capex for 2026, more than double 2025 — Polymarket · 2026-10-22
- pi ships rec inference engine, runs locally on M5 Max in two lines — _rockt · 2026-10-22
- Researcher warns GitLab flaw is 'really bad,' urges users to patch now — basedjensen · 2026-10-22
- PyTorch Con Demo Theater: 13 talks including Wan 2.2 video generation sped up 53.6x — PyTorch · 2026-10-22
- AWS walks through training Qwen3 three ways on Trainium with torchtitan — AWS ML Blog · 2026-10-22