The LiteLLM credential stealer harvests AWS credentials, GCP service account keys, Azure tokens, environment variables, browser data, and SSH private keys.