workloads[.]microsoftDomain
Reported by 1 independent source · first reported by Microsoft Security Blog · last reported
Last reported yesterday
What the reports say
1 report, newest first · the exact sentence from each-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“…romised package are detected and blocked; related suspicious script and network activity is identified across endpoints and cloud workloads[.]Microsoft Defender Antivirus”
Indicators reported together
named in the same reports- litellm-1.107.0[.]datain 1 report
- hxxp://www.litellm[.]dev/healthcheckin 1 report
- www.litellm[.]devin 1 report
- 9dd0a3926f96a37e…e9531390be25in 1 report
- 34bef04fe88ac9d0…acf5968305fain 1 report
- litellm[.]devin 1 report
- compromise[.]microsoftin 1 report
- remediation[.]microsoftin 1 report
- 03ac2a8b752605d1…8ce3d6f897eain 1 report
- b6122440d0d9cb1e…680dfa528465in 1 report
- hxxp://www.litellm[.]dev/healthcheckURLExfiltrationin 1 report
- hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtURLC2in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.