There is a new way to break into a company, and it has nothing to do with phishing emails or weak passwords. Attackers are now targeting the tools that software developers use to build and deploy software, including AI-powered software. If they can get inside those tools, they get inside every company that uses the resulting software.
CrowdStrike found a worm doing exactly this. It works in stages. First it quietly maps out the environment it has landed in. Then it steals login tokens and access keys. As it gains more access, it grabs more sensitive data. At any point, its operators can flip a switch and destroy files or lock out the legitimate owners entirely.
The hardest part to deal with is the invisibility. Modern software development is heavily automated. Machines run tasks on behalf of other machines constantly. This worm mimics exactly that kind of automated behavior, so it looks normal to most security tools. Defenders cannot easily separate the legitimate automation from the malicious automation because they produce the same type of activity trail.
The worm also uses time delays deliberately. Certain actions execute hours or even days after the initial infection. This breaks the obvious cause-and-effect chain that security analysts rely on to spot an intrusion.
This is not a lone experiment. A financially motivated group called TeamPCP has already run a real campaign using this approach. Between February and March 2026, it compromised several widely used developer and security tools, including a popular AI gateway called LiteLLM that routes requests across more than a hundred AI services. The group stole an estimated 300 gigabytes of data and around 500,000 credentials. The stolen credentials included cloud access tokens for AWS, Google Cloud, and Microsoft Azure. The FBI issued a formal alert about TeamPCP in July 2026.
North Korean state-sponsored groups have been running parallel operations. They targeted developers through fake job interviews, asking candidates to run code that was secretly malware. They wrote that malware in the same programming languages developers use for legitimate work, so it blended in perfectly on a developer's machine.
All of this reaches non-technical businesses in a direct way. When a software vendor your company uses gets hit, the attackers potentially gain access to the credentials and data your vendor holds on your behalf. The attack does not stop at the developer's laptop. It travels down the chain to every customer of that software.
One data point makes the scale clear. A popular AI package that was compromised in one of these campaigns had three million daily downloads. It was available in a poisoned state for just two hours. Even in that window, the number of potentially affected organizations was described by researchers as significant.
For any business operator, the practical question is: do you know which software tools your vendors and internal IT teams are using, and do you have any visibility into whether those tools have been touched by this wave of attacks? Most companies cannot answer that confidently, which is exactly why this class of attack is growing. The barrier to entry for attackers is low; the detection gap for defenders is wide.