Hackers Are Hiding Malware in AI Dev Pipelines

Attackers are now targeting the AI software supply chain with malware designed to blend into everyday development workflows. New research from CrowdStrike describes a worm found in the wild that can steal credentials, expand access inside a victim environment, exfiltrate sensitive data, and even destroy files or block legitimate access.

According to Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, the company has not yet linked the campaign to a specific threat actor. But he told WIRED that the activity matches a broader shift already seen from groups such as TeamPCP—which CrowdStrike tracks as Altered Spider—and North Korean groups targeting the AI software supply chain.

“This is one of the campaigns that we’ve seen showing that this is an emerging attack class. As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships. For the first time we’re experiencing how much AI and the AI toolchain has played into the broader tech ecosystem.”

The worm operates in stages. It begins with reconnaissance, then searches for access tokens, cryptographic keys, and server access credentials to send back to attackers. As it gains more privileges, it unpacks additional components and keeps harvesting credentials, especially npm tokens that can open access to software package servers and development functions such as pull requests.

Recommended reading

Kratos phishing kit taken down after 200 servers seized

With deeper access, the malware can collect increasingly sensitive data. It can also trigger a destructive capability Meyers called a “death switch,” which can wipe files or prevent legitimate users from accessing compromised infrastructure.

What makes the threat especially difficult to catch is how closely it resembles normal automation. Meyers described it as a case of a “needle in a needle stack,” because the malware behaves much like the tools organizations already use to build code. In AI development pipelines, he said, defenders also have fewer useful signals for spotting suspicious behavior.

The worm’s operators also inserted time delays, causing some malicious actions to run hours or even days after the initial compromise. That makes it harder for security teams to connect one event to the next—and to prove what caused the eventual damage.