A newly discovered computer worm unearthed by CrowdStrike is actively targeting artificial intelligence infrastructure, infiltrating software development pipelines to steal credentials, exfiltrate sensitive data, and even trigger a death switch that deletes files and blocks legitimate access. The threat, identified during investigations into AI software supply chain attacks, exploits the very same automation used by development teams to blend in, making detection extremely challenging.
The worm camouflages itself within legitimate AI system activities
Adam Meyers, CrowdStrike senior vice president of counter adversary work, explained that the malware operates in phases: first it conducts reconnaissance of the target environment, then searches for access tokens, cryptographic keys, and server credentials. Once privileged, it masquerades as a normal development automation process, making it nearly impossible to distinguish malicious behavior from legitimate operations. “It’s like a needle in a haystack, except this is a needle in a needle stack”, Meyers said, emphasizing that the same activities are difficult to trace because AI development systems operate identically.
Sponsored Protocol
Death switch and time delays to evade security
The worm's destructive capability, dubbed death switch, can delete critical files or deny access to authorized users. Additionally, the authors introduced time delays; different attack phases can trigger hours or days after the initial infection, hindering cause-and-effect correlation. According to Meyers, the detection surface is limited, as only a small portion of the activity generates telemetry signals. CrowdStrike is working on strategies to connect more dots, but structural collaboration across the industry is needed.
Sponsored Protocol
This worm represents an emerging attack class. As seen in other cybersecurity incidents, such as deepfake fraud causing billions in losses, cybercriminals exploit every vulnerability in rapidly expanding technologies. For further reading on computer worms, refer to the Wikipedia article.
