credential-stealer-activitylateral-movement-methoddata-exfiltration-methodremote-access-implant

PCPJack Cloud Worm Steals Credentials and Replaces TeamPCP Infections

Malware Intelligence · 5 sources · Updated 4mo ago · First seen May 7, 2026

SentinelLABS reported that attackers are deploying PCPJack, a modular Linux- and Python-based cloud worm built to steal credentials at scale from exposed cloud infrastructure. The framework targets cloud, container, developer, productivity, and financial environments, then spreads laterally through Docker, Kubernetes, Redis, MongoDB, RayML, SSH, and vulnerable web applications. Researchers said the malware removes TeamPCP-related artifacts from compromised systems, indicating it is designed to replace or evict earlier TeamPCP infections rather than coexist with them.

The campaign used a staging server hosting two related toolsets: the main PCPJack framework and a secondary credential-harvesting shell script paired with Sliver beacons. Stolen data was exfiltrated through Telegram and to a typosquatted CloudFront-like domain, suggesting an operation focused on credential theft and follow-on abuse rather than cryptomining. SentinelLABS found overlaps with historical TeamPCP targeting and tooling, but said the available evidence does not conclusively show that PCPJack operators are members of TeamPCP.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Aug 5, 2025 – Apr 20, 2026

Apr 20, 20266mo ago
SentinelLABS dates PCPJack campaign start to week of April 20, 2026
SentinelLABS said timing evidence indicates the PCPJack campaign began around the week of 2026-04-20. The report also noted the malware’s operators appeared focused on replacing TeamPCP infections and monetizing stolen credentials and cryptocurrency wallets rather than cryptomining.
After Replacing TeamPCP Malware, 'PCPJack' Steals Cloud Secrets
Aug 5, 20251y ago
SentinelLABS assesses PCPJack as financially motivated, not conclusively TeamPCP
Based on the absence of cryptomining behavior, SentinelLABS assessed the campaign as likely monetizing through credential theft, fraud, spam, extortion, or resale of stolen access. The researchers noted overlaps with TeamPCP targeting and tooling history but said there was no conclusive evidence directly linking PCPJack to TeamPCP membership.
Aug 5, 20251y ago
Second toolset with Sliver beacons found on PCPJack staging server
SentinelLABS identified a separate toolset on the same staging server consisting of a credential-harvesting shell script and Sliver beacons. This tooling exfiltrated data to a typosquatted CloudFront-like domain, indicating additional post-compromise capability tied to the infrastructure.
Aug 5, 20251y ago
Researchers uncover PCPJack credential theft and lateral movement modules
The analysis found PCPJack using a Linux bootstrap script and Python modules to steal credentials from cloud, container, developer, productivity, and financial environments. It was also observed spreading through Docker, Kubernetes, Redis, MongoDB, RayML, SSH, and vulnerable web applications, with exfiltration via Telegram.
Aug 5, 20251y ago
SentinelLABS identifies PCPJack cloud worm and TeamPCP eviction behavior
SentinelLABS reported discovering PCPJack, a modular credential-theft framework targeting exposed cloud infrastructure. The toolset was observed removing TeamPCP-related artifacts, suggesting it was designed to replace or evict prior TeamPCP infections rather than conduct cryptomining.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

PCPJack

Affected products

6 linked

RedisKubernetesMongodbDockerRayRay

Observables

26 linked

SHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••Domain••••••••.comURLhttps://••••••••.•••/•••••••SHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••Domain••••••••••••.comSHA-1 hash••••••••••••••••••••••••••••••••••••••••+18

Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · May 8, 2026

New PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB for Credential TheftOpen source ↗

Worm rubs out competitor's malware, then takes controlOpen source ↗

The Hacker NewsNews · May 7, 2026

PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud SystemsOpen source ↗

Dark ReadingNews · May 7, 2026

After Replacing TeamPCP Malware, 'PCPJack' Steals Cloud SecretsOpen source ↗

Sentinelone LabsNews · Aug 5, 2025

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale | SentinelOneOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News