Today’s look-out: Supplier/software supply-chain risk and staff social-engineering (copy/paste ‘fix’ scams)
What to look out for today
- Software supply-chain compromise: reports say the popular LiteLLM Python package was compromised and used to deliver credential-stealing and a backdoor via package downloads and container images.
- “ClickFix” attacks surging: criminals are increasingly tricking people into copying and pasting commands or “fix steps” into their computer (often disguised as an AI tool install, a browser/Office fix, CAPTCHA step, or chatbot advice).
- Ransomware readiness: authorities have issued a warning about SafePay ransomware actors targeting multiple sectors. SMEs should treat this as a prompt to double-check backup, access and incident readiness.
Why this matters to smaller businesses
- Supply-chain incidents bypass your usual checks: you may not be directly targeted, but you can still get hit through a dependency (developer libraries, MSP tooling, Docker images, automation scripts).
- ClickFix works on busy teams: it turns a normal user into the “installer” by persuading them to run steps that security tools might not expect.
- Ransomware impact is operational: even a short outage can halt invoicing, customer service, bookings, payroll and access to cloud apps.
Warning signs
- A web page, pop-up, email, or chatbot response that says: “To verify you’re human / fix this error, copy and paste this into Terminal/PowerShell/Command Prompt.”
- Search results or ads offering “instant AI installer”, “ChatGPT/Claude plugin”, “Teams/Zoom/Chrome fix”, or “invoice viewer” that leads to manual command steps.
- Developers/IT seeing unexpected dependency updates, new container pulls, or sudden authentication issues after a routine build/deploy.
- Unexpected MFA prompts, password reset emails, or new sign-ins from unfamiliar locations (possible credential theft).
- Ransomware precursors: unusual remote access logins, new admin accounts, endpoint protection disabled, or lots of failed login attempts.
How attackers may exploit the situation
- Supply-chain: attackers tamper with a trusted package or image so that when a team installs/updates it, malware can steal credentials (including cloud and developer secrets) or provide backdoor access.
- ClickFix: attackers use persuasion (“quick fix”, “verification”, “AI install”) to get a user to run instructions that download or enable malware, bypassing normal attachment and macro controls.
- Ransomware: stolen credentials and remote access are commonly used to spread, disrupt backups, and encrypt systems, leading to downtime and extortion.
What to do today
- Send a short staff alert: “Never copy/paste commands from a website, pop-up, email, or chatbot. If something asks you to do that, stop and report it.”
- For teams using Python/Docker/AI tooling: review recent installs/updates of third-party packages and container images used in production or automation; pause non-essential updates until checked.
- Check credential hygiene: confirm MFA is enabled on email, finance systems, and cloud admin accounts; review recent sign-in activity for anomalies.
- Ransomware basics check: confirm you have a recent offline/immutable backup and that you can restore key systems (file shares, finance, line-of-business apps).
Ask your IT provider
- Are we using LiteLLM (directly or through any internal tools, integrations, builds, or Docker images)? If yes, what’s the impact assessment and how are we verifying integrity?
- Do we have controls to stop or warn when users are prompted to run copy/paste “fix” commands (browser protections, endpoint controls, user prompts, web filtering)?
- What monitoring is in place for unusual sign-ins and credential theft (email, Microsoft 365/Google, VPN, remote access, admin accounts)?
- Can you confirm our last successful restore test date and which systems are covered (including cloud data and SaaS exports)?
- If ransomware hits, what is our step-by-step response plan and who must be called first (IT, insurer, legal, bank, comms)?
Patch watch - only one short paragraph, and only if relevant
There are reports of a widespread PHP issue that could lead to website/server compromise and outages. If your business runs a website or application on PHP (directly or via a web agency/host), ask today whether they’re aware and whether they’ve taken action to reduce outage risk and compromise risk.
One action today
Message all staff today: “Never copy/paste commands from a website, pop-up, email, or chatbot ‘fix’. If you’re asked to do this, stop and forward it to IT.”
Related Actions On Cyber resource
Actions On Cyber: Phishing & Social Engineering (including copy/paste ‘fix’ scams) – 2-minute staff checklist
Sources
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (The Hacker News)
- Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands (The Hacker News)
- ClickFix has never been bigger, and AI tools are its most convincing lure yet (BleepingComputer)
- CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors (CISA News)
- Widespread PHP Flaw May Cause Many Site Outages Today (Krebs on Security)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.