🎯 Encrypted exfiltration

The items that name it 5

• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  writeup2026-10-21It is written here as Encrypted exfiltration: AES-256-CBC with key wrapped by RSA-4096 OAEP-SHA256, packed as tar.gz (hdr.json, data.bin, key.bin), plain HTTP POST to a /healthcheck path with a spoofed MSIE 7.0 User-Agent.

  hdr.json, data.bin, key.bin

• LiteLLM supply chain compromise: What you need to know
  writeup2026-10-21

  Stolen data is encrypted with AES-256 and RSA-4096 and sent to the lookalike domain www.litellm[.]dev/healthcheck

• The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
  writeup2026-09-22

  Stolen data AES-256-GCM encrypted with a daily-rotating key derivable from message timestamp, sent as base64 code blocks to Discord

• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeup2026-05-23

  Collected data encrypted with AES-256 and sent to flipboxstudio[.]info/exfil

• Socket: Mini Shai-Hulud Hits @antv Ecosystem
  writeup2026-05-20

  Stolen data serialized, gzip-compressed, encrypted with AES-256-GCM, AES key wrapped with RSA-OAEP/SHA-256, sent to hardcoded HTTPS endpoint