The LiteLLM credential stealer targets API keys for OpenAI, Anthropic, and Cohere, along with proxy saved credentials and model configurations.