Loading malware…
PCPJack is a Linux-focused credential-theft framework and worm that targets exposed cloud and container infrastructure. It is designed to compromise internet-accessible services, remove artifacts associated with TeamPCP or PCPcat from infected environments, harvest a broad range of secrets, and propagate to additional internal and external systems. The malware has been observed targeting Docker, Kubernetes, Redis, MongoDB, RayML, SSH-accessible hosts, and vulnerable web applications, with exploitation tied to CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703.
The infection chain begins with a shell-based bootstrap component that prepares a hidden working environment, installs Python dependencies, downloads multiple modules, establishes persistence, launches the main orchestrator, and then deletes itself. Persistence is achieved through a systemd service when running with root privileges or cron-based mechanisms when unprivileged. Early execution logic explicitly searches for and removes competing TeamPCP-related processes, files, containers, services, and persistence artifacts, indicating an effort to take over previously compromised infrastructure.
PCPJack’s core functionality centers on large-scale secret harvesting from cloud, container, developer, productivity, messaging, financial, and cryptocurrency-related environments. Reported collection targets include environment files, configuration files, environment variables containing secrets, SSH keys, cloud metadata credentials, Kubernetes service account tokens, Docker secrets, Git history containing deleted secrets, and credentials for services such as AWS, GitHub, Slack, Office 365, WordPress, Stripe, Twilio, SendGrid, Mailgun, Binance, Coinbase, Kraken, Solana, OpenAI, Anthropic, Discord, DigitalOcean, Grafana Cloud, HashiCorp Vault, and 1Password. Exfiltrated data is encrypted using X25519 ECDH and ChaCha20-Poly1305 when supported, and the framework uses Telegram-based channels for command-and-control and data theft, with plaintext fallback noted when required cryptographic support is absent.
For propagation, PCPJack combines local lateral movement with external scanning. It abuses Kubernetes and Docker environments to enumerate workloads, access secrets, and attempt host escape; targets Redis for secret discovery and persistence abuse; and also reaches into MongoDB, RayML, and SSH-reachable systems. External target discovery includes scanning exposed cloud services and using Common Crawl parquet data to derive large sets of candidate hosts, enabling broad worm-like expansion without relying solely on hardcoded target lists. Researchers have also linked related operator infrastructure to a secondary toolset that harvested credentials and deployed Sliver implants on Linux across multiple CPU architectures.
PCPJack appears financially motivated and is notable for prioritizing credential theft and access monetization over cryptomining. Likely monetization paths include fraud, spam operations, extortion, and resale of stolen access. Its targeting overlap with TeamPCP, combined with deliberate eviction of TeamPCP tooling, has led to assessments that it may have been developed by a former TeamPCP affiliate or someone closely familiar with that ecosystem, although conclusive attribution is not available.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
41 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware's orchestrator module downloads parquet files from Common Crawl... The malware then scans through this open source (OSS) data for potential targets... PCPJack's most novel feature is the use of parquet files for finding new targets.
PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services
The Kubernetes spreading logic _lk checks for a Kubernetes service account token... then uses the service account to authenticate with the Kubernetes management API... The SSH propagation module _ls... These combinations are tried against any hosts running SSH.
PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services, exploits five vulnerabilities for initial access
Since the last update, the TeamPCP supply chain campaign produced its loudest stretch... Checkmarx confirmed its Jenkins AST plugin was trojanized... a new Mini Shai-Hulud worm poisoned roughly 170 npm and PyPI packages...
If not root, create two crontabs ... For persistence, _rwc performs a Redis cron rewrite, resulting in a cron job that fires bootstrap.sh every 5 minutes as root.
The infection begins with bootstrap.sh, a shell script designed for Linux systems. This script serves only to set up the environment and download additional payloads.
Download six Python modules from the attacker’s S3 URL in the following order: worm.py, parser.py, lateral.py, crypto_util.py, cloud_ranges.py, cloud_scan.py.
If not root, create two crontabs ... For persistence, _rwc performs a Redis cron rewrite, resulting in a cron job that fires bootstrap.sh every 5 minutes as root.
The Kubernetes spreading logic _lk checks for a Kubernetes service account token... then uses the service account to authenticate with the Kubernetes management API... The SSH propagation module _ls... These combinations are tried against any hosts running SSH.
The malware collects an unusually wide range of secrets, including SSH keys... Once inside, the worm harvests SSH keys and moves laterally...
A sophisticated new malware framework called PCPJack has been found actively targeting cloud environments across the internet... The worm zeroes in on Docker, Kubernetes, Redis, and MongoDB deployments, turning misconfigured or vulnerable systems into footholds...
Establish persistence: If run as root: create sys-monitor.service, which runs monitor.py, aka worm.py, an orchestrator script.
Initial entry is managed by a module called "bootstrap." Besides establishing persistence and downloading the malware's other Python modules, it spares no time in searching for and rooting out any processes belonging to TeamPCP.
If not root, create two crontabs ... For persistence, _rwc performs a Redis cron rewrite, resulting in a cron job that fires bootstrap.sh every 5 minutes as root.
Docker is targeted through a privileged container with host escape, Redis through cron injection, and RayML through a weaponized job submission.
The Kubernetes spreading logic _lk checks for a Kubernetes service account token... then uses the service account to authenticate with the Kubernetes management API... The SSH propagation module _ls... These combinations are tried against any hosts running SSH.
The malware collects an unusually wide range of secrets, including SSH keys... Once inside, the worm harvests SSH keys and moves laterally...
Establish persistence: If run as root: create sys-monitor.service, which runs monitor.py, aka worm.py, an orchestrator script.
Initial entry is managed by a module called "bootstrap." Besides establishing persistence and downloading the malware's other Python modules, it spares no time in searching for and rooting out any processes belonging to TeamPCP.
Lastly, it attempts a container escape by mounting the host filesystem to a new container ... If connected to a remote host, the spreader will bind-mount the root filesystem of the machine running the Docker management service to the remote instance’s /host path, which creates a container escape.
Sensitive strings are stored in the source code as a hex-encoded blob instead of clear text ... decrypts it by XORing each byte against the MD5 hash of the string urllib3.poolmanager ... The update binaries are Sliver C2 beacons compiled with the garble obfuscation tool.
The monitor.py script ... starts with logic designed to make the script appear like a benign system monitoring utility ... The binary is saved locally as /var/tmp/apt-daily-upgrade to blend in with system processes.
PCPJack... kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials
The Kubernetes spreading logic _lk checks for a Kubernetes service account token... then uses the service account to authenticate with the Kubernetes management API... The SSH propagation module _ls... These combinations are tried against any hosts running SSH.
Local Credential Theft On each compromised host, monitor.py executes a shell pipeline that steals: .env files and config files; Environment variables filtered for secrets, API keys, DB & SMTP creds; SSH private keys and targets from known_hosts, ~/.ssh/config, and bash history; AWS IMDS credentials; Kubernetes service account tokens; Docker secrets (/run/secrets/); Cryptocurrency wallets.
The Kubernetes spreading logic _lk checks for a Kubernetes service account token, which is present inside pods mounted in a cluster, then uses the service account to authenticate with the Kubernetes management API to enumerate namespaces and pods in the cluster.
Analyzing this script led us to discover a full framework dedicated to cloud credential harvesting and propagating onto other systems... This portion of the infection targets environment variables, config files, SSH keys, Docker secrets, Kubernetes tokens...
The script runs commands against each container to: Extract credentials from a list of file names and paths associated with secret stores; Harvest SSH private keys; Query the AWS Instance Metadata Service (IMDS); this works only in environments where IMDSv2 is not strictly enforced.
PCPJack... kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services
PCPJack... then kills TeamPCP processes and removes TeamPCP artifacts
The main orchestrator script, "monitor," runs next and begins collecting system metrics, similar to a benign system monitoring utility.
the group began by scanning for exposed Docker APIs... documented exploitation of exposed Docker APIs, Kubernetes clusters, Redis servers
The Kubernetes spreading logic _lk ... uses the service account to authenticate with the Kubernetes management API to enumerate namespaces and pods in the cluster. The Docker propagation function _ld ... lists all running containers.
Once inside, the worm harvests SSH keys and moves laterally by enumerating Kubernetes clusters and Docker daemons, then replicating itself to every reachable host.
The SSH propagation module _ls searches SSH key store locations ... parses ~/.ssh/known_hosts, ~/.ssh/config, and .bash_history for username and host combinations ... These combinations are tried against any hosts running SSH. On access, it runs bootstrap.sh on the remote machine to propagate the worm.
The cloud_ranges.py module ... collects a list of IP addresses assigned to AWS, Azure, Cloudflare, Cloudfront, Fastly, and Google Cloud Platform (GCP) ... cloud_scan.py scans external cloud services and attempts to propagate.
A threat report... documented exploitation of exposed Docker APIs, Kubernetes clusters, Redis servers, and a Next.js flaw the author called React2Shell
On access, it runs bootstrap.sh on the remote machine to propagate the worm.
Researchers also noted that the malware exfiltrates data to Telegram after encrypting it and splitting it into small chunks to fit message limits.
"worm.py ... uses Telegram for command-and-control (C2)"
a new self-spreading Mini Shai-Hulud worm poisoned roughly 170 npm and PyPI packages
SentinelOne’s analysis also uncovered a Sliver-based backdoor on the attacker’s staging server, compiled in three variants to support x86_64, x86, and ARM system architectures. This backdoor grants the operator persistent remote access even after initial exploitation ends.
It is called by monitor.py to exfiltrate the encrypted data before it is sent to the attacker’s Telegram channel ... The script then exfiltrates stolen data to hxxps://cdn[.]cloudfront-js[.]com:8443/u.
Researchers also noted that the malware exfiltrates data to Telegram after encrypting it and splitting it into small chunks to fit message limits.
It then encrypts all stolen data using X25519 ECDH and ChaCha20-Poly1305 before sending it to a Telegram channel, broken into small chunks to comply with message size limits.
That part of the infection downloads the worm itself, along with modules to enable lateral movement, parse credentials and encrypt them for exfiltration...
CAI explicitly seeks out and kills TeamPCP and PCPJack processes, to further monopolize on compromised targets
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.