Hidden Worm Targeting AI Infrastructure Hides in Victims' Blind Spots

Cybersecurity firm CrowdStrike identified a worm actively targeting AI infrastructure during an investigation of AI software supply chain attacks. The malware operates in phases, starting with reconnaissance, then stealing access tokens, cryptographic keys, and npm tokens to gain deeper access. It can ultimately deploy a 'death switch' to destroy files or block legitimate access. The worm's activity closely mimics legitimate automation used in code development, creating a 'needle in a needle stack' detection challenge. Attackers include time delays of hours or days to further evade detection. CrowdStrike has not attributed the activity to a specific actor but notes it fits broader trends seen with groups like TeamPCP and North Korean actors targeting the AI supply chain. The company emphasizes the need for structural solutions as AI coding agents become standard.