New research from cybersecurity firm Crowdstrike reveals that attackers are actively targeting the AI toolchain to steal credentials, access target environments, exfiltrate sensitive data, and even destroy files and systems.
Worm activity found in the wild
Researchers identified a worm while investigating attacks on the AI software supply chain. Adam Meyers, senior vice president of counter adversary work at Crowdstrike, says the company has not yet attributed the activity to a specific actor.
He notes the behaviour fits into larger trends where groups like TeamPCP, which Crowdstrike tracks as “Altered Spider”, and North Korean groups are targeting the AI supply chain.
“This is one of the campaigns that we’ve seen showing that this is an emerging attack class,” Meyers tells WIRED. “As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships. For the first time we’re experiencing how much AI and the AI toolchain has played into the broader tech ecosystem.”
Phased approach to stealing access
The worm identified by Crowdstrike operates in phases. It begins with reconnaissance to assess the target environment. Next, it searches for access tokens and other sensitive data, including cryptographic keys and server access credentials, which it delivers to attackers.
As the malware gains privileges, it further unpacks itself and continues to grab credentials. This includes “npm” tokens that grant access to key software package management servers and development capabilities such as pull requests.
The deeper the malware penetrates the system, the more sensitive data it can seize. At this stage, the malware can also deploy its destructive capability. Meyers refers to this as a “death switch” designed to destroy files or block legitimate access to the compromised infrastructure.
Malicious activity hidden in plain sight
The key finding is that much of the worm’s malicious activity occurs in blind spots. This is because so much of its behaviour mimics legitimate actions.
“It’s like a needle in a haystack except this is a needle in a needle stack,” Meyers says. “This looks very much like a lot of the automation organizations are using to build code, so it’s very difficult to detect.”
Meyers adds that in these AI software development pipelines, it is harder to gather the data points that security scanners and analysis tools traditionally use to detect potentially suspicious activity.
“There’s a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate,” Meyers says.
To hide in plain sight even more insidiously, the authors of the worm included time delays. Various capabilities will execute hours or even days after the groundwork is laid, making it harder for defenders to establish a cause and effect between certain events and outcomes.
Need for collaboration
Meyers says Crowdstrike is working on strategies to connect more of the dots. He emphasises that as AI software development expands, there is a pressing need for all players to collaborate on structural solutions.
“It’s a limited detection surface because only so much of this activity is actually going to produce any sort of telemetry signal for us to look at,” Meyers says, “so it becomes extremely onerous to determine what is legitimate and what is illegitimate behavior.”
