Hack & Fix @hack_and_fix

Explore the academy: academy.hackandfix.com #CyberSecurity #CyberAwareness #FraudPrevention #EthicalHacking #AISecurity #HackAndFix #CyberTraining #InformationSecurity #COFPS

Access the Certified Online Fraud Prevention Specialist (COFPS) course: academy.hackandfix.com/courses-archiv… 🎁 Free access coupon: STOP-SCAMS

A $10 billion AI startup just got gutted because a security scanner was the entry point.. and their own developers reportedly handed production credentials to an AI chatbot. Mercor trains AI models for OpenAI, Anthropic, and Google DeepMind. They manage 30,000+ contractors, process $2 million in daily payouts, and store recorded video interviews with face and voice data used for identity verification. Three 22-year-old college dropouts built it into a decacorn in two years. The data vault they were sitting on was one of the most sensitive in the entire AI ecosystem. The attack chain is the part that gets worse every sentence. TeamPCP compromised Trivy first. A security scanning tool made by Aqua Security. On March 19. Trivy has broad read access to every environment it scans by design, because that's how vulnerability scanners work. The credentials stolen from the security product were used to hijack LiteLLM, the open-source proxy that routes API calls to every major LLM provider. LiteLLM gets 3.4 million downloads per day. The poisoned version was uploaded straight to PyPI with no corresponding GitHub release, no tag, no review. Version 1.82.8 embedded the payload in a .pth file, which Python executes automatically at startup. You didn't need to import LiteLLM. You didn't need to call it. The malware fired the second Python opened. Three stages. Harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine. Deploy privileged containers across every node in the cluster. Install a persistent backdoor waiting for instructions. The stolen data was encrypted with a hardcoded 4096-bit RSA key and exfiltrated to models.litellm[.]cloud, a domain built to look legitimate. Mercor was downstream. Reports indicate their developers gave production credentials to Claude, an AI coding assistant, which was running with unrestricted system permissions. The compromised LiteLLM package came in through that pipeline. One poisoned dependency turned a $10 billion company's entire infrastructure into a credential harvesting operation. The haul: 939GB of source code. 211GB of database records containing resumes and personal data. 3TB of stored files including video interviews, face scans, and KYC documents. Full access to their TailScale VPN. 4TB total. Lapsus$ is now auctioning it with a "make an offer" price tag. The video interviews are the part that can never be undone. Faces and voices used for identity verification can generate deepfakes. Unlike passwords, biometrics cannot be reset. Thousands of doctors, lawyers, and engineers who signed up to train AI models just had their identities permanently compromised. Every AI company shipping fast right now has the same dependency chain underneath it. Nobody chose to install LiteLLM on that developer's machine. It came in as a dependency of a dependency of a tool they didn't even know they had.

Dominic Alvieri @AlvieriD

4 months ago

Mercor AI has allegedly been breached by Lapsus 939GB of source code 4TB of data in total All data from their TailScale VPN @mercor_ai

109 161 2K 1.4M 986

@SOCDefender 🎟️ CCSC 100% FREE Coupon: START-CYBER-100 lnkd.in/ebZBN2ce

@TheCyberPatron_ 🎟️ CCSC 100% FREE Coupon: START-CYBER-100 lnkd.in/ebZBN2ce

🚀 Want to start a career in cybersecurity but don’t know where to begin? Cybersecurity Career Starter Certification (CCSC) 💥 100% FREE — no catch. 🎟️ Use code: START-CYBER-100 🎁 Plus, a special career-support gift inside the course 🔗 Enroll now academy.hackandfix.com/courses-archiv…

🚨 How a Trusted Tool Became a Stealthy Threat Vector Our latest Hack & Fix investigation breaks down the Notepad++ supply-chain attack that compromised the update process for months. Full analysis on our blog: blog.hackandfix.com/the-notepad-su…

⏰ ONLY 5 DAYS LEFT! ⏰ The 75% OFF XMAS-75 coupon for Hack & Fix Academy certifications is about to expire! 🚨 After that, prices go back to normal. No extensions. 👉 Enroll now: academy.hackandfix.com #CyberSecurity #HackAndFix #OnlineLearning #CyberCareer #LimitedOffer

#HackAndFixAcademy #CyberSecurity #CyberCareer #StartCyber #CyberEducation #LearnCyber #CyberCommunity #TechCommunity #LearningTogether #FutureInTech #CareerStarter #EthicalHacking #InfoSec #ITCareers #CyberTraining #BeginnerFriendly

💙 Built for our community — not for spam 🎓 The Cybersecurity Career Starter Certification (CCSC) is now accessible using a special community-only coupon: 🎟️ START-CYBER-100 👉 Start here academy.hackandfix.com/courses-archiv…

🚀 We’re Live on Discord! 🎉 Hack & Fix Academy is excited to announce the launch of our official Discord server. 💡 Join us today and be part of the Hack & Fix Academy community! discord.gg/VAKQxhs4MC #CyberSecurity #LearningCommunity #HackAndFixAcademy #DiscordCommunity

🚨 All Hack & Fix Academy courses are now 75% OFF! Use code: 🎟️ XMAS-75 and grab every course at a huge discount: Original $20 → $5 Original $99 → $24.75 ⏳ Hurry—𝐨𝐟𝐟𝐞𝐫 𝐞𝐧𝐝𝐬 31 𝐉𝐚𝐧𝐮𝐚𝐫𝐲 2026! academy.hackandfix.com

🚀 New Certification Courses Live! Hack & Fix Academy just released: 🔐 Certified AI Security Specialist 🛡️ Certified Online Fraud Prevention Specialist academy.hackandfix.com/courses-archiv… #CyberSecurity #AISecurity #Certifications #HackAndFix

🚀 ~17,000 learners enrolled in the 𝐏𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐏𝐫𝐞𝐯𝐞𝐧𝐭𝐢𝐨𝐧 𝐒𝐩𝐞𝐜𝐢𝐚𝐥𝐢𝐬𝐭 (𝐂𝐏𝐏𝐒) CPPS coupon extended until: 🗓 January 4, 2026 – 00:00 UTC 🎟 Coupon: phishing-100 75% 𝐎𝐅𝐅 𝐝𝐢𝐬𝐜𝐨𝐮𝐧𝐭 for all courses: 🎟 Coupon: XMAS-75 academy.hackandfix.com

⏳ Only a few days remaining! 𝐂𝐞𝐫𝐭𝐢𝐟𝐢𝐞𝐝 𝐏𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐏𝐫𝐞𝐯𝐞𝐧𝐭𝐢𝐧 𝐒𝐩𝐞𝐜𝐢𝐚𝐥𝐢𝐬𝐭 𝐜𝐨𝐮𝐫𝐬𝐞 𝐅𝐑𝐄𝐄 The promotion ends on 31 December 2025 — don’t wait! 🎟️ Use coupon code phishing-100 at checkout academy.hackandfix.com/courses-archiv…

🎄 Merry Christmas from Hack & Fix Academy! 🎓 𝐀𝐋𝐋 𝐜𝐞𝐫𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐚𝐫𝐞 𝐧𝐨𝐰 75% 𝐎𝐅𝐅 👉 Use code at checkout: XMAS-75 🛡️𝐂𝐏𝐏𝐒 𝐅𝐑𝐄𝐄 𝐮𝐧𝐭𝐢𝐥 31 𝐃𝐞𝐜𝐞𝐦𝐛𝐞𝐫 2025 💥 Use code: phishing-100 academy.hackandfix.com

🚨 Cryptocurrency is the financial backbone of modern cybercrime. From ransomware and phishing to darknet marketplaces and fraud networks, threat actors rely on crypto to move money fast, across borders, and at scale. 📖 Read the full article here: blog.hackandfix.com/cryptocurrency…

Certified Phishing Prevention Specialist course is completely FREE throughout December. Use the coupon code phishing-100 at checkout: 📷 academy.hackandfix.com/courses-archiv…

🎃 Halloween Special at @hack_and_fix Academy! 👻 To celebrate, we’re offering a massive 85% OFF on all cybersecurity courses. 🕷️ 🎁 Use coupon code HALLOHACK85 at checkout 🔗 Explore courses: academy.hackandfix.com

🚨 Stop threats before they strike — with Hack & Fix. We uncover, investigate & eliminate digital threats: blockchain tracing, dark web OSINT, red teaming, pentesting & forensics. 📩 [email protected] hackandfix.com/Contact