Credentials stolen in a supply-chain attack on a security tool are still working, five months after the breach was discovered.
Security researchers at CloudSEK and Hudson Rock say a financially motivated group called TeamPCP compromised a build of Trivy, an open-source vulnerability scanner made by Aqua Security. LiteLLM, a gateway that translates calls to more than 100 AI models into one API format, automatically pulled in the poisoned Trivy package without verifying it. That gave the attackers server-administrator access and let them install a credential stealer. The haul included cloud keys, SSH keys, Kubernetes tokens, and AI provider keys tied to more than 2,500 organizations, among them Cisco, Samsung, AWS, Airbus U.S. Space & Defense, Thales, and the London Stock Exchange Group.
This is not one company's data spilling out. It is a shared set of keys to hundreds of companies' cloud infrastructure, CI/CD pipelines, and code repositories, all harvested through a single trusted dependency. Independent researcher Kevin Beaumont tested some of the leaked keys and found they still worked, even though the affected organization said it had rotated them.
Rotating a key on paper and rotating it in practice are apparently two different chores.