Sandworm_Mode worm targets AI toolchains in software development
A self-propagating worm dubbed Sandworm_Mode reportedly targets AI coding assistants and software development environments, stealing credentials and sensitive data while evading detection by mimicking legitimate development activity.
What happened
CrowdStrike researchers discovered a self-propagating worm dubbed Sandworm_Mode while investigating AI software supply chain attacks. The malware was first discovered by Socket in February.
The worm operates in phases: initial reconnaissance of the target environment, theft of access tokens and sensitive data including cryptographic keys and server credentials, and deployment of destructive capabilities. It targets npm tokens, API keys for nine major LLM providers, CI/CD pipelines, and automated systems that build, test and publish code.
Reported impact
The malware spreads through code repositories with minimal detection and places defenders at a growing disadvantage. Its activity mimics legitimate development actions, blending in with tens of thousands of daily commands in environments using AI development tools.
The worm can destroy files and block legitimate access to compromised infrastructure. It paces itself with multi-day delays between initial access and follow-on activity, and automatically destroys compromised environments if it cannot spread or accomplish its objectives.
Index analysis
Much of the worm's malicious activity occurs in blind spots because its behavior mimics legitimate automated actions used in code building. Security scanners have difficulty detecting suspicious activity because legitimate AI coding systems operate similarly to the worm.
In AI software development pipelines, there is significant telemetry overlap between legitimate AI coding systems and the malware, making it very difficult to discern malicious from legitimate activity based on available data. The worm's multi-day delays separate initial access from follow-on activity, creating gaps in victims' telemetry windows that complicate detection and attribution.
Governance controls
CrowdStrike has not yet attributed the activity to a specific actor, though the attack fits patterns of evolving supply chain threats targeting AI toolchains. CrowdStrike conducted a four-month review of Sandworm_Mode but has not determined the attacker's specific intent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.