Loading story…
SentinelLABS reported that attackers are deploying PCPJack, a modular Linux- and Python-based cloud worm built to steal credentials at scale from exposed cloud infrastructure. The framework targets cloud, container, developer, productivity, and financial environments, then spreads laterally through Docker, Kubernetes, Redis, MongoDB, RayML, SSH, and vulnerable web applications. Researchers said the malware removes TeamPCP-related artifacts from compromised systems, indicating it is designed to replace or evict earlier TeamPCP infections rather than coexist with them.
The campaign used a staging server hosting two related toolsets: the main PCPJack framework and a secondary credential-harvesting shell script paired with Sliver beacons. Stolen data was exfiltrated through Telegram and to a typosquatted CloudFront-like domain, suggesting an operation focused on credential theft and follow-on abuse rather than cryptomining. SentinelLABS found overlaps with historical TeamPCP targeting and tooling, but said the available evidence does not conclusively show that PCPJack operators are members of TeamPCP.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
SentinelLABS said timing evidence indicates the PCPJack campaign began around the week of 2026-04-20. The report also noted the malware’s operators appeared focused on replacing TeamPCP infections and monetizing stolen credentials and cryptocurrency wallets rather than cryptomining.
Based on the absence of cryptomining behavior, SentinelLABS assessed the campaign as likely monetizing through credential theft, fraud, spam, extortion, or resale of stolen access. The researchers noted overlaps with TeamPCP targeting and tooling history but said there was no conclusive evidence directly linking PCPJack to TeamPCP membership.
SentinelLABS identified a separate toolset on the same staging server consisting of a credential-harvesting shell script and Sliver beacons. This tooling exfiltrated data to a typosquatted CloudFront-like domain, indicating additional post-compromise capability tied to the infrastructure.
The analysis found PCPJack using a Linux bootstrap script and Python modules to steal credentials from cloud, container, developer, productivity, and financial environments. It was also observed spreading through Docker, Kubernetes, Redis, MongoDB, RayML, SSH, and vulnerable web applications, with exfiltration via Telegram.
SentinelLABS reported discovering PCPJack, a modular credential-theft framework targeting exposed cloud infrastructure. The toolset was observed removing TeamPCP-related artifacts, suggesting it was designed to replace or evict prior TeamPCP infections rather than conduct cryptomining.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetheregister.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the **P2PInfect** botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the `SLAVEOF` command and, in some cases, leveraging `CVE-2022-0543` for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads. Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled **TeamPCP** as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, **PCPJack**, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.
Jun 29, 2026
Researchers at Hunt.io uncovered a covert **230-node SMTP relay network** built from compromised Linux servers hosted on **AWS, Google Cloud, and Microsoft Azure** after finding two unauthenticated open directories on `213.136.80[.]73`. The exposed directories contained source code, binaries, deployment logs, scanners, exploitation tools, and a live **Sliver** configuration, revealing an active operation that used **Sliver** implants and **Chisel** tunneling to convert business servers across the U.S., Europe, and Asia into monitored SMTP-capable proxies. Deployment artifacts showed at least one completed wave in March 2026 with 230 successful uploads and executions, while verification data suggested earlier undocumented activity using different port ranges. The recovered toolkit showed a structured workflow that established reverse **SOCKS5** tunnels, persisted on Linux systems as `/var/tmp/.xs` or `xsync`, tested outbound access to `smtp.gmail[.]com:587`, assigned deterministic proxy ports, and synchronized verified relay nodes every five minutes via SCP to a downstream server at `38.242.204[.]245`. Hunt.io said the infrastructure was likely intended for large-scale email delivery such as **spam or phishing**, although the final use remains unconfirmed. The campaign has been linked to **PCPJack**, a cloud-focused credential-theft framework previously identified by SentinelOne, but researchers said the relationship between PCPJack and TeamPCP infrastructure remains unclear and attribution is based primarily on shared infrastructure rather than definitive operator identification.
Jun 29, 2026
Researchers linked **TeamPCP** to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the **Operation PCPcat** and **React2Shell** activity said attackers exploited vulnerable **Next.js** deployments and compromised roughly **59,000 servers**, using them to steal credentials and build follow-on access. Separate investigations into the **CanisterWorm** campaign found dozens of malicious **npm** packages carrying hidden `postinstall` scripts that stole npm tokens from `.npmrc`, `/etc/npmrc`, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level `systemd` service named **`pgmon`** and fetched later-stage payloads through **Internet Computer** canister infrastructure, complicating takedown efforts. Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the **Xygeni GitHub Action** compromise found the same custom **ShadowLink** backdoor protocol used in malware that exploited **TP-Link** and **ASUS** routers, including abuse of **`CVE-2024-21833`** to install **microsocks** and maintain SOCKS5 proxy persistence via cron, `rc.local`, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own **CipherForce** operation and activity aligned with the **Vect** ransomware ecosystem; related fallout included **ownCloud** disclosing build infrastructure exposure through **`CVE-2026-33634`** associated with the Trivy compromise.
Jun 29, 2026