The LiteLLM remote access trojan spawns a background daemon that polls attacker infrastructure every hour for commands or checks a GitHub dead drop repository.