Microsoft TI: LiteLLM gateways actively exploited for cred theft and cryptomining

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Plan: Microsoft Threat Intelligence documents active exploitation of exposed LiteLLM gateways leading to credential theft and persistence — no KEV or PoC signal, but if you run LiteLLM or similar AI proxies, audit internet exposure, rotate API keys, and verify no unauthorized processes are running on those hosts.
SOC/IR — Act: Active attack chain with detectable post-exploitation stages (credential harvesting, persistence, cryptomining) reported by Microsoft TI — pull the blog post for IOCs, then hunt for anomalous processes and outbound connections on any hosts running AI gateway software since the publication date.
Leader — Plan: AI workloads are now an established attack surface for credential theft and resource abuse; this quarter, ensure AI infrastructure (gateways, API proxies, GPU hosts) is included in your hardening and access-review scope alongside traditional edge assets.

macOS Screen Sharing auth bypass exploited to drop Monero miner

Sat, 15 Aug 2026 11:32:14 +0000

Engineer — Act: Active exploitation with public PoC — audit your macOS fleet for Screen Sharing (VNC) exposure and apply Apple’s patch immediately; disable Screen Sharing on hosts where it isn’t required.
SOC/IR — Act: Hunt for unexpected xmrig or Monero miner processes on macOS endpoints and check for anomalous outbound connections to mining pools since the PoC went public.
Leader — Learn: Active cryptomining campaign on macOS is unlikely to require board-level action, but confirms macOS is not a safe-harbor — useful context for endpoint policy discussions.