Loading malware…
PCPJack is a Linux-focused credential-theft framework and worm that targets exposed cloud and container infrastructure. It is designed to compromise internet-accessible services, remove artifacts associated with TeamPCP or PCPcat from infected environments, harvest a broad range of secrets, and propagate to additional internal and external systems. The malware has been observed targeting Docker, Kubernetes, Redis, MongoDB, RayML, SSH-accessible hosts, and vulnerable web applications, with exploitation tied to CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703.
The infection chain begins with a shell-based bootstrap component that prepares a hidden working environment, installs Python dependencies, downloads multiple modules, establishes persistence, launches the main orchestrator, and then deletes itself. Persistence is achieved through a systemd service when running with root privileges or cron-based mechanisms when unprivileged. Early execution logic explicitly searches for and removes competing TeamPCP-related processes, files, containers, services, and persistence artifacts, indicating an effort to take over previously compromised infrastructure.
PCPJack’s core functionality centers on large-scale secret harvesting from cloud, container, developer, productivity, messaging, financial, and cryptocurrency-related environments. Reported collection targets include environment files, configuration files, environment variables containing secrets, SSH keys, cloud metadata credentials, Kubernetes service account tokens, Docker secrets, Git history containing deleted secrets, and credentials for services such as AWS, GitHub, Slack, Office 365, WordPress, Stripe, Twilio, SendGrid, Mailgun, Binance, Coinbase, Kraken, Solana, OpenAI, Anthropic, Discord, DigitalOcean, Grafana Cloud, HashiCorp Vault, and 1Password. Exfiltrated data is encrypted using X25519 ECDH and ChaCha20-Poly1305 when supported, and the framework uses Telegram-based channels for command-and-control and data theft, with plaintext fallback noted when required cryptographic support is absent.
For propagation, PCPJack combines local lateral movement with external scanning. It abuses Kubernetes and Docker environments to enumerate workloads, access secrets, and attempt host escape; targets Redis for secret discovery and persistence abuse; and also reaches into MongoDB, RayML, and SSH-reachable systems. External target discovery includes scanning exposed cloud services and using Common Crawl parquet data to derive large sets of candidate hosts, enabling broad worm-like expansion without relying solely on hardcoded target lists. Researchers have also linked related operator infrastructure to a secondary toolset that harvested credentials and deployed Sliver implants on Linux across multiple CPU architectures.
PCPJack appears financially motivated and is notable for prioritizing credential theft and access monetization over cryptomining. Likely monetization paths include fraud, spam operations, extortion, and resale of stolen access. Its targeting overlap with TeamPCP, combined with deliberate eviction of TeamPCP tooling, has led to assessments that it may have been developed by a former TeamPCP affiliate or someone closely familiar with that ecosystem, although conclusive attribution is not available.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
PCPJack ... exploits five vulnerabilities for initial access (... CVE-2025-9501 W3 Total Cache RCE...). | On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services, exploits five vulnerabilities for initial access (CVE-2025-29927 Next.js middleware authentication bypass...). | On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
PCPJack ... exploits five vulnerabilities for initial access (... CVE-2025-55182 Next.js Server Actions deserialization...). | On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
PCPJack ... exploits five vulnerabilities for initial access (... CVE-2025-48703 CentOS Web Panel command injection). | On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
PCPJack ... exploits five vulnerabilities for initial access (... CVE-2026-1357 WPVivid arbitrary file upload...). | On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services... then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
If not root, create two crontabs ... For persistence, _rwc performs a Redis cron rewrite, resulting in a cron job that fires bootstrap.sh every 5 minutes as root.
If not root, create two crontabs ... For persistence, _rwc performs a Redis cron rewrite, resulting in a cron job that fires bootstrap.sh every 5 minutes as root.
Docker is targeted through a privileged container with host escape, Redis through cron injection, and RayML through a weaponized job submission.
Establish persistence: If run as root: create sys-monitor.service, which runs monitor.py, aka worm.py, an orchestrator script.
Lastly, it attempts a container escape by mounting the host filesystem to a new container ... If connected to a remote host, the spreader will bind-mount the root filesystem of the machine running the Docker management service to the remote instance’s /host path, which creates a container escape.
Sensitive strings are stored in the source code as a hex-encoded blob instead of clear text ... decrypts it by XORing each byte against the MD5 hash of the string urllib3.poolmanager ... The update binaries are Sliver C2 beacons compiled with the garble obfuscation tool.
Local Credential Theft On each compromised host, monitor.py executes a shell pipeline that steals: .env files and config files; Environment variables filtered for secrets, API keys, DB & SMTP creds; SSH private keys and targets from known_hosts, ~/.ssh/config, and bash history; AWS IMDS credentials; Kubernetes service account tokens; Docker secrets (/run/secrets/); Cryptocurrency wallets.
The Kubernetes spreading logic _lk checks for a Kubernetes service account token, which is present inside pods mounted in a cluster, then uses the service account to authenticate with the Kubernetes management API to enumerate namespaces and pods in the cluster.
Analyzing this script led us to discover a full framework dedicated to cloud credential harvesting and propagating onto other systems... This portion of the infection targets environment variables, config files, SSH keys, Docker secrets, Kubernetes tokens...
The script runs commands against each container to: Extract credentials from a list of file names and paths associated with secret stores; Harvest SSH private keys; Query the AWS Instance Metadata Service (IMDS); this works only in environments where IMDSv2 is not strictly enforced.
PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services
PCPJack... then kills TeamPCP processes and removes TeamPCP artifacts
The SSH propagation module _ls searches SSH key store locations ... parses ~/.ssh/known_hosts, ~/.ssh/config, and .bash_history for username and host combinations ... These combinations are tried against any hosts running SSH. On access, it runs bootstrap.sh on the remote machine to propagate the worm.
The cloud_ranges.py module ... collects a list of IP addresses assigned to AWS, Azure, Cloudflare, Cloudfront, Fastly, and Google Cloud Platform (GCP) ... cloud_scan.py scans external cloud services and attempts to propagate.
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newer credential- and secret-stealing worm that removes TeamPCP artifacts from compromised cloud infrastructure, described as a competitor and inspiration for CAI.
A rival worm targeting exposed cloud infrastructure similar to TeamPCP’s operations. It removes TeamPCP tooling from infected hosts, suggesting competitive takeover behavior on compromised systems.
A Linux-focused malware/toolset used to gain initial access and harvest credentials from compromised servers; the recovered infrastructure suggests it feeds a Sliver beacon pool used for follow-on proxy deployment.
Credential-stealing malware framework targeting exposed cloud environments. It uses a Linux shell script to create a hidden workspace, install Python dependencies, download modules, establish persistence, launch an orchestrator, remove TeamPCP artifacts, exfiltrate encrypted data to Telegram, and spread laterally by targeting exposed services and vulnerable web applications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.