Loading malware…
SANDCLOCK is a Python-based credential stealer used by the financially motivated threat actor TeamPCP, tracked as UNC6780, in software supply-chain attacks during March and April 2026. It targets Linux systems, Kubernetes environments, developer workstations, and CI/CD runners, particularly environments holding cloud, source-control, package-publishing, and AI-service credentials.
SANDCLOCK harvests AWS credentials, GitHub tokens, SSH private keys, Kubernetes ServiceAccount tokens, environment variables, cryptocurrency wallet data, and AI-provider API keys. It searches local configuration data and process memory for secrets, includes container-escape functionality, and can escalate privileges to root on compromised build systems. In compromised LiteLLM packages, a Python startup mechanism enables automatic execution when the interpreter starts, without requiring an application to import LiteLLM.
Distribution occurs through trojanized software and compromised build tooling. The March 2026 campaign compromised Trivy components used by LiteLLM's build pipeline, enabling attackers to obtain publishing credentials and distribute malicious LiteLLM releases through PyPI. SANDCLOCK encrypts stolen material before exfiltration and disguises outbound transfers as legitimate monitoring or telemetry traffic. If direct exfiltration fails, it can create public GitHub repositories under victim accounts and upload stolen material as release assets. Credentials obtained through TeamPCP's campaigns have supported subsequent intrusions and monetization through ransomware and extortion partnerships.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Those releases installed the SANDCLOCK credential stealer, which searched affected systems for cloud keys, Kubernetes tokens, cryptocurrency wallet information, and credentials for AI services.
SANDCLOCK, used by TeamPCP in March and April 2026, is a Python-based credential stealer designed for Linux and Kubernetes environments.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
...an Server gesendet, die eine Typosquatting-Domain nutzten.
The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
The attackers gained access to build systems and developer workstations through a malicious GitHub Action plugin.
TeamPCP ... has conducted a series of large-scale software supply chain compromises targeting PyPI, npm, and Docker Hub.
The malicious LiteLLM releases were published after the compromised Trivy component reached the project’s build environment. The incident carries the risk of trusted package supply chain attacks: one altered dependency can reach environments before maintainers react.
TeamPCP allegedly inserted malicious code into software hosted on public repositories, which was then unwittingly used by other developers. The group injected malicious code into legitimate software packages and pushed trojanized versions through normal distribution channels.
The targets weren’t end users. They were the tools developers trust every day inside their build pipelines.
Execution T1059 Command & Scripting (CI runner) Malicious code runs inside CI/CD job context
Three consecutive xinference PyPI releases... were published from a bot account with a malicious base64-encoded payload injected directly into init .py, executing automatically on package import.
...haben Angreifer im Python Packages Index (PyPI) kompromittierte Pakete eingeschleust. Diese wurden offenbar von automatisierten Build-Systemen zigtausendfach heruntergeladen und verwendet...
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
The attackers gained access to build systems and developer workstations through a malicious GitHub Action plugin.
File path /proc/<pid>/mem Process memory path reportedly scraped for CI/CD secrets
Privilege Escalation T1068 Exploitation for Priv-Esc SANDCLOCK escalated to root on compromised runners
The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
SANDCLOCK ... is designed to operate on Linux and interact with Kubernetes. It includes container escape functionality.
The injected payload was the SANDCLOCK credential stealer, a purpose-built tool that mimics legitimate telemetry traffic — disguising exfiltration as POST requests to domains resembling monitoring services — to evade network detection controls.
File path /proc/<pid>/mem Process memory path reportedly scraped for CI/CD secrets
The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
GTIG also named TeamPCP's credential stealer payload as SANDCLOCK.
GTIG also named TeamPCP's credential stealer payload as SANDCLOCK.
SANDCLOCK scraped secrets from CI runner memory and transmitted AWS keys, GitHub tokens, Kubernetes configurations, and SSH private keys to attacker-controlled infrastructure.
Over 2,500+ organizations and hundreds of thousands of CI/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys
On a CI/CD runner, the credential-stealing payload sought elevated access and searched for SSH keys, cloud credentials, Kubernetes tokens, environment files and secrets in process memory.
SANDCLOCK: a credential stealing tool used by TeamPCP that extracts AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data.
Zu den geklauten Daten zählen laut CloudSEK Cloud-Keys, Repository-Token, SSH-Keys, Kubernetes-Secrets, Zugangsdaten für Paket-Publishing, Umgebungsvariablen und KI-Anbieter-Keys.
Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions.
the backdoored releases included not only a credential harvester but also a Kubernetes lateral movement toolkit and a persistent backdoor
On every compromised runner the stealer escalated to root and swept SSH keys, cloud credentials, Kubernetes tokens, .env files and in-memory secrets from /proc/<pid>/mem
GTIG also named TeamPCP's credential stealer payload as SANDCLOCK.
Collection T1114 / T1530 local capture Writes secrets to local 127.0.0.1 capture files
The worm executes via npm postinstall hook, harvests roughly 40 credential categories via regex sweep... The payload swept AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials.
extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets
Collection T1114 / T1530 local capture Writes secrets to local 127.0.0.1 capture files
Indicators of Compromise (IOC) List Domains/URLs scan.aquasecurtiy.org ... check.git-service.com ... recv.hackmoltrepeat.com ... audit.checkmarx.cx/v1/telemetry
the backdoored releases included not only a credential harvester but also a Kubernetes lateral movement toolkit and a persistent backdoor, giving the attacker ongoing access to the LLM-serving infrastructure of any organization that installed the affected packages
Die Daten haben die Angreifer mit AES-256 und einem fest einprogrammierten RSA-4096-Key verschlüsselt und an Server gesendet, die eine Typosquatting-Domain nutzten.
Over 300 private GitHub repositories containing Cisco source code were cloned... AWS keys were stolen and used for unauthorized activities across Cisco's cloud accounts
Exfiltration T1567 Exfiltration Over Web Service Capture files aggregated and exfiltrated to actor storage
Wenn das Ausschleusen fehlschlägt, legt die Malware ein öffentliches Repository innerhalb des GitHub-Kontos der Opfer an und verfrachtet die Daten dorthin.
The attackers gained access to build systems and developer workstations through a malicious GitHub Action plugin.
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.