Exploitation campaign against exposed AI infrastructure: Microsoft's investigations of compromised LiteLLM, RAGFlow and Kestra workloads, and Wiz honeypot telemetry of the same MCP RCE chain, blind prompt injection and in-memory credential theft

Multiple real customer environments investigated by Microsoft Defender across three distinct AI workloads; Wiz's 90-day honeypots mimicking LiteLLM, Flowise, LangChain, Langflow, ChromaDB and Ollama recorded the same tooling

One in-the-wild campaign observed from two vantage points, fused 2026-09-21 from two parallel drafts: Microsoft's victim investigations (Security Blog, 2026-08-26) and Wiz Threat Research's honeypot telemetry (2026-08-27, Yaara Shriki). The same CVE-2026-42271 + CVE-2026-48710 chain, the same detached cryptominer tradecraft and the same in-memory LiteLLM key theft appear in both, so a second vendor's telemetry of the same attacker tooling is evidence for one record, not a second incident. MICROSOFT: three real Defender investigations. LiteLLM: entry consistent with the 42271+48710 chain; the attacker read the gateway PID-1 environment for the master key, provider keys and DATABASE_URL, reached Azure PostgreSQL and dumped LiteLLM_ProxyModelTable and LiteLLM_VerificationToken; miner plus SSH-key persistence. RAGFlow: SSRF-style recon, in-process RCE and a Python hook in the TenantLLM credential flow (low confidence on the specific CVE). Kestra: workflow-origin shell execution and XMRig, initial access via CVE-2026-49869. Guidance: 'Treat AI gateways as Tier-0 secrets stores.' WIZ: (1) CVE-2026-59822 auth bypass with single-character Bearer tokens and the 42271+48710 chain for unauthenticated RCE dropping a Monero miner, with Wiz linking the Qilin ransomware group to active exploitation; (2) blind prompt injection against LangChain, Flowise, OpenWebUI and Node-RED using DNS OAST callbacks to confirm shell-tool execution (reconstructed payload), ending in XMRig; (3) AI-native post-exploitation reading the LiteLLM master key from Python module memory and staging a miner under an /app/data/.claude/ directory renamed 'unicorn'. impact_realized TRUE on Microsoft's real victims; honeypots alone would not qualify. Xref AIR-2026-0187 (LiteLLM vulnerability umbrella): this record is the distinct exploitation campaign with its own realized-harm question, per the split rule in CURATION.md.