Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
With the spread of artificial intelligence tools and become… Deeply ingrained In the field of software development around the world, New search From cybersecurity firm Crowdstrike, it shows how attackers are actively targeting the AI toolchain to steal access credentials, gain deeper access to the target environment, exfiltrate sensitive data, and even destroy target files and systems — all while finding new ways to cover their tracks.
Researchers discovered a worm in the wild while investigating AI software supply chain attacks. Adam Myers, senior vice president of CrowdStrike’s counter-adversarial business, says the company has not yet attributed the activity to a specific actor, but it fits with larger developments in how attackers attack. TeamPCP (which Crowdstrike tracks as “Altered Spider”) and North Korean groups Targeting the AI software supply chain.
“This is one of the campaigns we’ve seen that shows that this is an emerging attack category,” Myers tells WIRED. “As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships. For the first time, we are testing the impact of AI and the AI toolchain on the broader technology ecosystem.”
The identified CrowdStrike worm works in stages. First, it conducts reconnaissance to evaluate the target environment. It then looks for access tokens and other sensitive data, such as encryption keys and server access credentials that it can hand over to attackers. As the malware gains privileges, it dismantles itself further and continues to hijack credentials, especially “npm” tokens that provide access to key software package management servers and other development capabilities such as pull requests.
The deeper the malware gets into the system, the more sensitive data it can take over. At this point, the malware can also deploy its destructive potential, or what Myers calls the “death switch,” to destroy files or prevent legitimate access to the compromised infrastructure.
However, the main finding is that much of the worm’s malicious activity occurs in blind spots, because much of its behavior mimics legitimate actions. “It’s like a needle in a haystack, except it’s a needle in a stack of needles,” Myers says. “This looks a lot like a lot of automation organizations use to build code, so it’s very difficult to figure out.”
Myers also adds that in these AI software development pipelines, it is difficult to collect the data points that security scanners and analysis tools traditionally use to detect potentially suspicious activity.
“There’s a lot of overlap in telemetry because legitimate AI cryptographic systems work in the same way that this worm does, so it becomes very difficult to distinguish from the telemetry you have what’s legitimate and what’s not,” Myers says.
To hide in plain sight even more insidiously, the worm’s authors included time delays whereby various abilities would be executed hours or even days after the foundation was laid, making it difficult for defenders to determine cause and effect of certain events leading to certain outcomes.
Myers says Crowdstrike has been working on strategies to connect more dots, but stresses that with the explosion in AI software development, there is an urgent need for all players to collaborate on architectural solutions.
“It’s a limited detection space because only so much of that activity will actually produce any kind of telemetry signal for us to look at, so it becomes very difficult to determine what is legitimate behavior and what is illicit behavior,” Myers says.
