Cybersecurity Firm Discovers Worm Lurking in AI Infrastructure Blind Spots
CrowdStrike researchers have found a worm targeting AI development supply chains, capable of stealing credentials and destroying files while mimicking legitimate activity to evade detection.
Cybersecurity company CrowdStrike has identified a new worm targeting artificial intelligence (AI) software supply chains. The malware can perform reconnaissance, steal access credentials, and even destroy files, all while remaining hidden by mimicking legitimate actions.
The worm operates in multiple stages. First, it conducts reconnaissance to assess the target environment. Then it searches for access tokens and other sensitive data, such as cryptographic keys and server credentials, which it delivers to attackers. As the malware gains privileges, it unpacks itself and continues harvesting credentials, particularly “npm” tokens that provide access to key software package management servers and development capabilities like pull requests.
The deeper the worm penetrates the system, the more sensitive data it can access. At this point, the malware can also deploy its destructive capability—a “death switch”—to destroy files or block legitimate access to compromised infrastructure.
The key finding is that much of the worm's malicious activity takes place in blind spots because its behavior closely resembles legitimate actions. “It's like a needle in a haystack, except this is a needle in a needle stack,” says Adam Meyers, CrowdStrike's senior vice president of counter adversary work. “This looks very much like a lot of the automation organizations are using to build code, so it’s very difficult to detect.”
Additionally, in AI development pipelines, it is harder to collect the data points that security scanners traditionally use to detect suspicious activity. “There’s a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate,” Meyers says.
To hide even more insidiously, the worm's authors included time delays that cause various capabilities to execute hours or days after initial intrusion, making it harder for defenders to establish cause and effect.
CrowdStrike is working on strategies to connect more dots, but Meyers emphasizes that as AI software development explodes, there is a pressing need for collaborative structural solutions. “It’s a limited detection surface because only so much of this activity is actually going to produce any sort of telemetry signal for us to look at,” Meyers says, “so it becomes extremely onerous to determine what is legitimate and what is illegitimate behavior.”
