A Covert Hacking Tool Aimed at AI Infrastructure is Hiding in Plain Sight for Its Victims.

As AI tools expand and become integral to software development globally, new findings from cybersecurity company Crowdstrike reveal that attackers are increasingly focusing on the AI toolchain to steal access credentials, obtain deeper infiltration into target environments, exfiltrate sensitive information, and even obliterate target files and systems—all while discovering innovative ways to conceal their actions.

During their investigations into AI software supply chain attacks, researchers uncovered a worm in the wild. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, notes that while the activity has not yet been linked to a specific actor, it aligns with broader trends in how attackers like TeamPCP (tracked as “Altered Spider” by Crowdstrike) and North Korean groups are exploiting the AI software supply chain.

“This is one of the campaigns demonstrating that this is an evolving attack class,” Meyers tells WIRED. “As AI coding agents become the norm in development, supply chain threats are adapting to exploit those trust connections. For the first time, we’re seeing the extent to which AI and its toolchain are influencing the larger tech ecosystem.”

The worm identified by CrowdStrike operates in phases. Initially, it conducts reconnaissance to evaluate the target environment. It then seeks access tokens and sensitive information, such as cryptographic keys and server access credentials, which it can relay to the attackers. As the malware escalates its privileges, it unpacks further and continues to collect credentials, especially “npm” tokens that grant access to critical software package management servers and other development functionalities like pull requests.

The deeper the malware penetrates the system, the more sensitive data it can capture. At this stage, it can also activate its destructive capability, referred to by Meyers as a “death switch,” to eliminate files or restrict legitimate access to the compromised infrastructure.

A crucial discovery is that much of the worm’s malicious activity occurs in what can be characterized as blind spots, since its behavior closely resembles legitimate actions. “It’s like a needle in a haystack, but this time it’s a needle in a needle stack,” Meyers explains. “This mimics many automated processes organizations use to build code, making it exceedingly difficult to detect.”

Meyers also points out that within these AI software development pipelines, gathering the data points that security scanners and analysis tools typically rely on to identify potentially suspicious activities is much more challenging.

“There’s considerable telemetry overlap since legitimate AI coding systems function similarly to this worm, making it very hard to differentiate from the telemetry you have which is valid and what is fraudulent,” Meyers adds.

To further obscure its presence, the authors of the worm have incorporated time delays, causing various actions to execute hours or even days after initial steps are laid, complicating defenders’ ability to trace cause and effect for specific incidents.

Meyers states that Crowdstrike is developing strategies to connect more of the dots but emphasizes that as AI software development flourishes, there is a critical need for all stakeholders to collaborate on structural solutions.

“It’s a limited detection surface because only a fraction of this activity generates any telemetry signals for us to analyze,” Meyers explains. “Consequently, it becomes profoundly difficult to discern what constitutes legitimate versus illegitimate behavior.”