As AI tools spread and become deeply embedded in software development around the world, new research from cybersecurity firm CrowdStrike shows how attackers are actively targeting AI toolchains to steal access credentials, gain deep access to targeted environments, exfiltrate sensitive data, and even destroy target files and systems – and are finding new ways to cover their tracks.
Researchers discovered a worm in the wild while investigating AI software supply chain attacks. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, says the company has not yet attributed the activity to any specific actor, but it fits into the larger development that attackers like TeamPCP (which CrowdStrike tracks as “Altered Spider”) and North Korean groups are targeting the AI software supply chain.
“This is one of the campaigns that we’ve seen that shows this is an emerging attack class,” Meyers told WIRED. “As AI coding agent development becomes the norm, supply chain threats are evolving to exploit those trusted relationships. For the first time, we are experiencing just how much of a role AI and AI toolchains have played in the broader tech ecosystem.”
The worm identified by CrowdStrike works in stages. First of all it conducts reconnaissance to assess the target environment. It then looks for access tokens and other sensitive data, such as cryptographic keys and server access credentials that it can pass on to attackers. As the malware gains privileges, it unpacks itself and continues to capture credentials, particularly “npm” tokens that grant access to key software package management servers and other development capabilities such as pull requests.
The deeper the malware penetrates the system, the more sensitive data it can capture. At this point, the malware can also deploy its destructive capability, or what Meyers calls the “death switch”, to destroy files or block legitimate access to the compromised infrastructure.
However, the key finding is that most of the worm’s malicious activity occurs essentially in blind spots, as much of its behavior mimics legitimate actions. “It’s like a needle in a haystack, except it’s a needle in a needle stack,” says Meyers. “It seems like a lot of automation organizations are using it to generate code, so it’s very difficult to detect.”
Meyers also says that in these AI software development pipelines, it is difficult to collect the data points that security scanners and analysis tools traditionally use to detect potentially suspicious activity.
“There’s a lot of telemetry overlap because legitimate AI coding systems are doing the same thing as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate,” says Meyers.
To hide even more insidiously in plain sight, the writers of the worm incorporated time delays where various abilities would be executed hours or even days after the groundwork, making it even more difficult for defenders to establish the cause and effect of certain events leading to certain results.
Meyers says CrowdStrike is working on strategies to connect more dots, but he emphasizes that as AI software development grows, there is an urgent need for all players to collaborate on structural solutions.
“It’s a limited detection surface because only so much of this activity is actually going to produce some kind of telemetry signal for us to see,” says Meyers, “so it makes it extremely difficult to determine what is legitimate and what is illegitimate behavior.”
