TeamPCP Cloud stealer
TeamPCP Cloud Stealer is a credential-harvesting infostealer used in TeamPCP supply-chain attacks in March 2026, especially against cloud-native and CI/CD environments. It was deployed through compromised trusted software and developer tooling including Aqua Security Trivy and its GitHub Actions, Checkmarx GitHub Actions and related OpenVSX artifacts, and malicious LiteLLM PyPI releases. The malware self-identifies in source code as "TeamPCP Cloud stealer," which analysts used as a key attribution marker linking the activity to the TeamPCP threat group, also tracked as DeadCatx3, PCPcat, and ShellForce.
Its core behavior is to steal secrets from GitHub Actions runners and developer systems while preserving normal tool functionality to reduce detection. Reported capabilities include dumping GitHub Actions Runner.Worker process memory via /proc/*/mem; harvesting SSH keys; Git credentials; cloud credentials for AWS, Google Cloud, and Microsoft Azure; Kubernetes tokens and secrets; Docker credentials; .env files; database credentials; CI/CD configurations; TLS private keys; VPN data; cryptocurrency wallet data including Solana wallets; and Slack and Discord webhook URLs. Multiple reports also state that it queried the AWS Instance Metadata Service at 169.254.169.254 for IAM credentials and searched repositories and filesystems for exposed secrets.
Collected data was packaged as tpcp.tar.gz, encrypted using AES-256/AES-256-CBC with RSA-4096 hybrid encryption, and exfiltrated to attacker-controlled infrastructure. Reported exfiltration endpoints and related indicators include scan.aquasecurtiy[.]org, checkmarx[.]zone, models.litellm[.]cloud, 45.148.10.212, and 83.142.209.11. Several reports also describe a fallback exfiltration mechanism in which the malware created GitHub repositories named tpcp-docs or docs-tpcp inside victim organizations to store stolen data.
Variants associated with the broader campaign added persistence and post-compromise functionality. In compromised Trivy binaries, the malware reportedly attempted persistence on developer machines via a systemd-backed Python component such as ~/.config/systemd/user/sysmon.py. In malicious LiteLLM releases, a TeamPCP Cloud Stealer variant was deployed alongside a persistence script; version 1.82.8 additionally used a .pth file for execution at Python startup, and reports state it installed a disguised systemd user-service backdoor and attempted Kubernetes lateral movement by deploying privileged pods. The malware was used in attacks that affected CI/CD pipelines and downstream enterprise environments, with reporting linking it to compromises of organizations using the poisoned Trivy, Checkmarx, and LiteLLM components.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On 19 March, TeamPCP launched a coordinated multi-channel attack that resulted in CVE-2026-33634, a supply chain compromise affecting the official Trivy distribution infrastructure | Deployed "TeamPCP Cloud Stealer", a purpose-built payload designed for CI/CD runner environments that dumped process memory from the GitHub Actions runner, swept SSH keys, cloud provider credentials, and Kubernetes secrets, then encrypted and exfiltrated the collected data using AES-256 and RSA-4096 to attacker-controlled servers.
Their malware consistently self-identifies through an embedded string, “TeamPCP Cloud stealer,” which has become one of the clearest attribution markers across all campaign phases.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actor force-pushed 75 of 76 version tags in the aquasecurity/trivy-action repository, redirecting them to malicious commits containing the "TeamPCP Cloud stealer."
Security analysts have linked the activity to the TeamPCP threat group, which has conducted a series of supply chain attacks targeting developer platforms including GitHub, PyPI, npm, and Docker. The group is known for deploying a credential-harvesting tool referred to as the TeamPCP Cloud Stealer.
When the infected software runs, the TeamPCP Cloud Stealer searches the system memory and files for digital master keys that allow access to a company’s servers. It specifically hunts for Kubernetes tokens and Solana cryptocurrency wallets.
The malware self-identifies as TeamPCP Cloud stealer in a Python comment on the final line of the embedded filesystem credential harvester.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
Cisco Systems... experienced a cyberattack in which threat actors infiltrated its internal development environment using stolen credentials obtained through a recent supply chain compromise... During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
On March 19, 2026, the threat actor known as TeamPCP compromised Aqua Security's Trivy vulnerability scanner and its associated GitHub Actions, injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories... the same attack pattern subsequently appeared in a second, unrelated GitHub Action for Checkmarx's AST.
Execution
2 techniques
Execution
Persistence
4 techniques
Persistence
Version 1.82.8 introduces a more aggressive feature that installs a '.pth' file named 'litellm_init.pth' to the Python environment. Because Python automatically processes all '.pth' files when the interpreter starts, the malicious code would be executed whenever Python is run.
Cisco Systems... experienced a cyberattack in which threat actors infiltrated its internal development environment using stolen credentials obtained through a recent supply chain compromise... During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
The cloud stealer payload also includes an additional base64 encoded script that is installed as a systemd user service disguised as a "System Telemetry Service," which periodically contacts a remote server at checkmarx[.]zone to download and execute additional payloads.
Privilege Escalation
4 techniques
Privilege Escalation
Version 1.82.8 introduces a more aggressive feature that installs a '.pth' file named 'litellm_init.pth' to the Python environment. Because Python automatically processes all '.pth' files when the interpreter starts, the malicious code would be executed whenever Python is run.
Cisco Systems... experienced a cyberattack in which threat actors infiltrated its internal development environment using stolen credentials obtained through a recent supply chain compromise... During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
The cloud stealer payload also includes an additional base64 encoded script that is installed as a systemd user service disguised as a "System Telemetry Service," which periodically contacts a remote server at checkmarx[.]zone to download and execute additional payloads.
Stealth
5 techniques
Stealth
The malicious code was injected into 'litellm/proxy/proxy_server.py' as a base64 encoded payload, which is decoded and executed whenever the module is imported.
Egress traffic was routed via POST requests to typosquatted domains designed to blend into manual log reviews scan.aquasecurtiy[.]org for Trivy, and checkmarx.zone (83.142.209.11) or audit.checkmarx.cx for Checkmarx.
Cisco Systems... experienced a cyberattack in which threat actors infiltrated its internal development environment using stolen credentials obtained through a recent supply chain compromise... During the incident, attackers obtained multiple Amazon Web Services keys and used them to carry out unauthorized activities across a limited number of Cisco cloud accounts.
Credential Access
8 techniques
Credential Access
Deployed "TeamPCP Cloud Stealer", a purpose-built payload designed for CI/CD runner environments that dumped process memory from the GitHub Actions runner, swept SSH keys, cloud provider credentials, and Kubernetes secrets...
The Trivy breach also affected the LiteLLM open-source Python library in an attack that infected tens of thousands of devices with its "TeamPCP Cloud Stealer" information-stealing malware.
When a compromised Trivy action executes in a workflow, it extracts GitHub personal access tokens (PATs) and other secrets from the Runner.Worker process memory. If those tokens have write access to repositories that also use Checkmarx actions, the attacker can use them to push malicious code to additional action dependencies.
Deployed "TeamPCP Cloud Stealer" ... swept SSH keys, cloud provider credentials, and Kubernetes secrets...
...swept SSH keys, cloud provider credentials, and Kubernetes secrets...
Cloud metadata harvesting : Queried the AWS Instance Metadata Service (IMDS) at 169.254.169.254 for IAM credentials... IMDS credential harvesting : curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/
Discovery
1 technique
Discovery
Collection
2 techniques
Collection
Command and Control
1 technique
Command and Control
The cloud stealer payload also includes an additional base64 encoded script that is installed as a systemd user service disguised as a "System Telemetry Service," which periodically contacts a remote server at checkmarx[.]zone to download and execute additional payloads.
Exfiltration
3 techniques
Exfiltration
...then encrypted and exfiltrated the collected data using AES-256 and RSA-4096 to attacker-controlled servers.
IOCs tracked for this family
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information-stealing malware used in a supply-chain attack that infected tens of thousands of devices via the compromised LiteLLM open-source Python library.
A purpose-built stealer for CI/CD runner environments that harvests process memory, SSH keys, cloud credentials, and Kubernetes secrets, encrypts the stolen data, and exfiltrates it to attacker-controlled infrastructure. It also has a fallback exfiltration method using a repository named tpcp-docs inside the victim GitHub organization.
A purpose-built stealer for CI/CD runner environments that harvests process memory, SSH keys, cloud credentials, and Kubernetes secrets, then encrypts and exfiltrates the stolen data. It also has a fallback exfiltration mechanism using a repository named tpcp-docs inside the victim's GitHub organization.
Credential-stealing malware used across TeamPCP campaign phases to harvest secrets from CI/CD runners and victim environments, package them, encrypt them, and exfiltrate them for follow-on compromise.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.