IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE6 IOCs

LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor

OP
OpenSourceMalware
Published October 21, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREunknownCAPABILITYMETA StealerVICTIMunknown
Adversary
Infrastructure
Capability(1)
Victim

Indicators of Compromise

6 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA2566ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2dfMediumScore 53/100First seen
SHA2567f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdbMediumScore 54/100First seen
SHA2569dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25HighScore 56/100First seen
SHA25620a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24bMediumScore 53/100First seen
SHA25634bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305faHighScore 56/100First seen
SHA2567598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86dHighScore 56/100First seen

IOC Relationship Graph

6 total IOCs
SHA256
SHA2566Malware1LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python BackdoorREPORT6ea3d8ef6cf73a72d8df…7f191632e7320705d154…9dd0a3926f96a37eb86c…20a59e5a285799e7cf7f…34bef04fe88ac9d0aae0…7598727f209d717041db…META Stealer
scroll to zoom · drag to pan · click IOC to open