My minute-by-minute response to the LiteLLM malware attack

Re:My minute-by-minute response to the LiteLLM malware attack by Shank on Thursday March 26, 2026 @01:25PM (#47533207)

Probably one of the best things about AI/LLMs is the democratization of reverse engineering and analysis of payloads like this. It’s a very esoteric skill to learn by hand and not very immediately rewarding out of intellectual curiosity most times. You can definitely get pointed in the right direction easily, now, though!

[ Parent | on HN ]

Re:My minute-by-minute response to the LiteLLM malware attack by gus_ on Thursday March 26, 2026 @03:17PM (#47534477)

In this case, this has nothing to do with reverse engineering, it's basic system administration.

See how the AI points you in the "right" direction:

  What likely happened:
  The exec(base64.b64decode('...')) pattern is not malware — it's how Python tooling (including Claude Code's Bash tool) passes code snippets to python -c while avoiding shell escaping issues.

Any base64 string passed to python via cmdline should be considered as HIGHLY suspicious, by default. Or anything executed from /tmp, /var/tmp, /dev/shm.

  Exfiltrates data to https://models.litellm.cloud/ encrypted with RSA

if @op would have had Lulu or LittleSnitch installed, they would probably have noticed (and blocked) suspicious outbound connections from unexpected binaries.

Having said this, uploading a binary to Claude for analysis is a different story.

[ Parent | on HN ]

Re:My minute-by-minute response to the LiteLLM malware attack by recursivegirth on Thursday March 26, 2026 @06:42PM (#47536776)

Thanks, learned something new. I found and setup Open Snitch on my machine - super intuitive. This is going to give me great peace of mind.

[ Parent | on HN ]

Re:My minute-by-minute response to the LiteLLM malware attack by Fibonar on Thursday March 26, 2026 @02:10PM (#47533804)

I’ve entertained myself with CTF walkthroughs on YouTube before and had been meaning to try it out. But yeah I feel it falls under the same category as lock picking, fun to LARP, unlikely to stumble across in my day job.

[ Parent | on HN ]