Loading malware…
TeamPCP Cloud Stealer is a credential-harvesting malware payload associated with the TeamPCP threat group, also tracked under aliases including DeadCatx3, PCPcat, and ShellForce. It was used prominently in March 2026 software supply-chain compromises affecting developer and security tooling embedded in CI/CD workflows, including Trivy, Checkmarx GitHub Actions, and LiteLLM. The malware was designed to preserve the expected functionality of trojanized tools while covertly stealing secrets from build runners, developer systems, and cloud-connected environments.
Its core behavior centers on harvesting credentials and sensitive configuration material from CI/CD and cloud-native environments. Reported targets include GitHub Actions runner memory, SSH keys, Git credentials, cloud provider credentials for AWS, Google Cloud, and Microsoft Azure, Kubernetes tokens and kubeconfig material, Docker credentials, environment files, database secrets, TLS private keys, VPN-related data, CI/CD configuration secrets, cryptocurrency wallet material, and collaboration webhook tokens. In GitHub Actions environments, it was observed dumping runner process memory to recover secrets that would otherwise be masked in logs. It also searched local filesystems and, in some cases, queried cloud metadata services to obtain temporary cloud credentials.
Collected data was packaged into an encrypted archive using hybrid cryptography based on AES-256 and RSA-4096 before exfiltration to attacker-controlled infrastructure. Multiple reports also describe fallback exfiltration through attacker-created repositories within victim GitHub organizations when direct outbound exfiltration failed. In some deployments, particularly outside ephemeral CI runners, the malware attempted persistence through a user-level systemd service and a Python-based follow-on loader that periodically polled remote infrastructure for additional payloads.
The malware was distributed through supply-chain compromise rather than direct end-user delivery. TeamPCP inserted it into trusted release channels by force-moving GitHub Action tags, publishing trojanized binaries and container images, and uploading malicious Python package versions. In LiteLLM, a related variant executed on package import, and a more aggressive release used Python startup processing to trigger execution whenever the interpreter launched. Some reporting also links TeamPCP follow-on activity to Kubernetes abuse, privileged pod deployment, persistence tooling, and destructive logic in adjacent payloads, but the consistently supported role of TeamPCP Cloud Stealer itself is large-scale theft and exfiltration of credentials and secrets from cloud and CI/CD environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The payload design was consistent across all three targets... The malware was self-attributed in its string table: "TeamPCP Cloud stealer."
Their malware consistently self-identifies through an embedded string, “TeamPCP Cloud stealer,” which has become one of the clearest attribution markers across all campaign phases.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The payload design was consistent across all three targets... The malware was self-attributed in its string table: "TeamPCP Cloud stealer."
When the infected software runs, the TeamPCP Cloud Stealer searches the system memory and files for digital master keys that allow access to a company’s servers. It specifically hunts for Kubernetes tokens and Solana cryptocurrency wallets.
The malware self-identifies as TeamPCP Cloud stealer in a Python comment on the final line of the embedded filesystem credential harvester.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
The threat actor known as TeamPCP orchestrated a four-wave supply chain campaign between March 19–24, 2026, compromising Trivy, Checkmarx KICS/AST GitHub Actions, and LiteLLM.
Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting and immediate credential harvesting...
Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting and immediate credential harvesting...
it executes a base64-encoded Python filesystem harvester signed "TeamPCP Cloud stealer"
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
The stealer performed memory scraping of /proc/*/mem to dump the Runner.Worker process
On March 19, during the active compromise window, the Commission's pipeline executed the malicious Trivy release and exfiltrated an AWS API key carrying management rights over multiple Commission AWS accounts.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
The attack uses WAV steganography to hide encrypted second-stage payloads within valid audio files, allowing the malware to bypass network filters while establishing persistence
the malware exfiltrated stolen data to the vendor-themed typosquat domain checkmarx[.]zone .
The stealer performed memory scraping of /proc/*/mem to dump the Runner.Worker process
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
TeamPCP Cloud Stealer, a purpose-built payload designed for CI/CD runner environments that dumped process memory from the GitHub Actions runner, swept SSH keys, cloud provider credentials, and Kubernetes secrets
Beyond the primary targets, TeamPCP leveraged harvested tokens to infect 48 additional packages.
Stage 1 reads /proc/PID/environ for the current process and any running Runner.Worker , Runner.Listener , runsvc , or run.sh processes. It captures environment variables matching env or ssh in the key name, and if a value points to a file on disk, reads that file too.
It captures environment variables matching env or ssh in the key name, and if a value points to a file on disk, reads that file too.
it executes a base64-encoded Python filesystem harvester ... that reads ... shell history
immediate credential harvesting from AWS/GCP/Azure credentials using the compromised endpoint’s instance metadata service (IMDS).
it executes a base64-encoded Python filesystem harvester signed "TeamPCP Cloud stealer" that reads SSH keys, cloud credentials, Kubernetes configs, Docker credentials, .env files, terraform state, shell history, database configs, TLS private keys, and cryptocurrency wallets
the Python filesystem harvester ... reads SSH keys, cloud credentials, Kubernetes configs, Docker credentials, .env files, terraform state, shell history, database configs, TLS private keys, and cryptocurrency wallets, walking multiple directories up to 6 levels deep
then encrypted and exfiltrated the collected data using AES-256 and RSA-4096 to attacker-controlled servers.
147 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information-stealing malware used in a supply-chain attack that infected tens of thousands of devices via the compromised LiteLLM open-source Python library.
A purpose-built stealer for CI/CD runner environments that harvests process memory, SSH keys, cloud credentials, and Kubernetes secrets, encrypts the stolen data, and exfiltrates it to attacker-controlled infrastructure. It also has a fallback exfiltration method using a repository named tpcp-docs inside the victim GitHub organization.
Purpose-built stealer for CI/CD runner environments that harvests process memory, SSH keys, cloud credentials, and Kubernetes secrets, then encrypts and exfiltrates the stolen data; it can fall back to storing secrets in a repository named tpcp-docs inside the victim GitHub organization.
Information-stealing malware delivered via a compromised LiteLLM PyPI package, impacting tens of thousands of devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.