Loading story…
TeamPCP allegedly conducted a large-scale software supply-chain compromise campaign, tampering with hundreds of open-source packages, stealing developer accounts, and breaching more than 1,000 organizations. The operation deployed the self-propagating Shai-Hulud worm to automate repository compromise and propagation. Google threat intelligence reportedly placed an undercover analyst inside the group, while Australian authorities arrested and charged two suspected members in August 2026.
A Mandiant investigation separately found an attacker hijacked an active AI coding-assistant session at a SaaS provider, used a malicious recommended package to install an infostealer, and stole GitHub OAuth tokens, repository secrets, and source code. The attacker spread Shai-Hulud through about 100 internal repositories, poisoned a package in the provider's official namespace, and infected another employee who pulled the compromised release. Open-source reporting also links TeamPCP-related aliases, including CipherForce and PCPcat, through shared underground infrastructure and contact identifiers, though those links do not establish the operators' real-world identities or definitively attribute every claimed intrusion to TeamPCP.
Trace attribution and downstream blast radius.
12 events from the most recent confirmed update back to the earliest known activity.
Mandiant reported an intrusion at an unnamed SaaS provider in which an attacker hijacked a developer's active AI coding-assistant session, installed an infostealer via a poisoned PyPI package, and stole GitHub OAuth tokens, repository secrets, and product source code. The attacker spread the self-propagating Shai-Hulud worm to roughly 100 internal repositories and infected a second employee through a poisoned official-namespace package.
Third-party messages in the Data Hoarder Telegram channel claimed that BreachForums owners, including T-PCP, had been arrested and that the forum would become a honeypot. The report did not independently verify either claim.
A Telegram account identified as T-PCP, using TeamPCP-style naming and a black-cat avatar also seen on associated accounts, had a recorded profile-creation date of August 8, 2026.
A historical snapshot showed that a Tor site previously indexed as CipherForce was branded as TeamPCP, providing infrastructure-based evidence of a later TeamPCP rebrand.
Australian authorities arrested and charged two alleged TeamPCP members. The available source specifies only that the action occurred in August 2026.
A June snapshot of Breached showed the TeamPCP account holding co-owner and staff-member roles.
A TeamPCP account announced that it had become a co-owner of the Breached forum and claimed responsibility for functions including infrastructure reliability, staff management, escrow, partnerships, and database/tool verification.
CipherForce posted a "BMW Group Internal Documents/Recon" listing marked for sale, describing purported German automotive-sector data and using an offer-based price and underground-forum contact methods.
A Telegram post attributed to PCPcat alleged exploitation of Next.js and React environments affecting more than 59,000 servers. The report treats this as activity associated with the wider identity set later linked to TeamPCP, not definitive attribution to TeamPCP itself.
Google's threat-intelligence group reportedly embedded an undercover analyst within TeamPCP's inner circle.
TeamPCP allegedly tainted hundreds of open-source programs with malware, stole developer accounts, and released a Dune-themed self-propagating worm to automate supply-chain compromises. The campaign reportedly breached more than 1,000 companies.
A TeamPCP account presenting itself as a Breached co-owner offered approximately 4,000 private GitHub repositories and internal organizations for sale, with a $50,000 minimum offer and a stated current offer of $95,000. A Telegram message promoting the sale reused Session and TOX identifiers associated with the TeamPCP/CipherForce cluster.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcestealthmole-intelligence-hub.blogspot.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Source code for the **Shai-Hulud** supply-chain worm attributed to **TeamPCP** was briefly exposed on GitHub, with repositories reportedly inviting others to modify keys and command-and-control settings and, in some cases, released under the **MIT License**. Researchers said the leaked code closely matched malware used in recent npm and PyPI compromises tied to packages associated with **TanStack, Mistral AI, and OpenSearch**, and revealed a modular framework built to steal credentials from developer workstations, CI/CD runners, cloud environments, Kubernetes, and HashiCorp Vault. The malware propagates by abusing stolen **GitHub**, **npm**, cloud, and **OIDC** credentials to poison repositories and publish backdoored packages, while maintaining persistence through GitHub workflows, Python `.pth` hooks, IDE and AI coding assistant configuration changes, system services, and Windows Startup entries. Analysis of the leaked framework showed encrypted exfiltration, GitHub dead-drop and signed-commit fallback channels, Sigstore provenance forgery, and destructive behavior including an org-membership-gated wiper and coercive deadman switch. GitHub removed the original repositories and has reportedly been taking down reposted copies, but forks and modified variants were already observed, and within days copycat actors began publishing Shai-Hulud-derived malicious npm packages such as **`chalk-tempalte`** and Axios-themed typosquats. Security firms warned that the public release turns an already successful credential-theft and software supply-chain operation into a reusable toolkit for other threat actors, increasing the likelihood of broader attacks across npm, PyPI, GitHub Actions, Docker Hub, OpenVSX, and developer tooling ecosystems.
Jun 29, 2026
Researchers have linked **TeamPCP** to a broader criminal operation spanning AI infrastructure hijacking and open-source software supply-chain compromise. Oligo Security said infrastructure overlaps tied TeamPCP to aliases including **IronErn** and **TA-NATALSTATUS**, and connected the group to the **ShadowRay 2.0** campaign, which abused Ray’s exposed Jobs API behavior tracked as `CVE-2023-48022` to achieve remote code execution on internet-facing Ray clusters. The campaign turned compromised AI systems into a self-propagating botnet used for CPU and GPU cryptomining, including targeting **NVIDIA A100** resources, while also enabling reverse shells, persistence, data theft, and DDoS activity. Separate threat intelligence reporting said TeamPCP evolved from cloud intrusions and **XMRig**-based Monero mining into a credential-theft-led supply-chain operation that allegedly compromised projects and distribution channels including **Trivy**, **Checkmarx KICS**, **LiteLLM**, the **Telnyx Python SDK**, **Bitwarden CLI**, **Xinference**, and **elementary-data**, and was also linked to an AWS breach affecting the **European Commission**. ThreatMon said the group’s March-April 2026 activity affected more than **1,000 SaaS environments**, exposed roughly **500,000 credentials**, and led to more than **300 GB** of data theft, while newer reporting suggests the actor has likely been active since **2020** and has accelerated its operations by exploiting AI adoption, automation, and trust in open-source ecosystems.
Sep 3, 2026
Researchers linked **TeamPCP** to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the **Operation PCPcat** and **React2Shell** activity said attackers exploited vulnerable **Next.js** deployments and compromised roughly **59,000 servers**, using them to steal credentials and build follow-on access. Separate investigations into the **CanisterWorm** campaign found dozens of malicious **npm** packages carrying hidden `postinstall` scripts that stole npm tokens from `.npmrc`, `/etc/npmrc`, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level `systemd` service named **`pgmon`** and fetched later-stage payloads through **Internet Computer** canister infrastructure, complicating takedown efforts. Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the **Xygeni GitHub Action** compromise found the same custom **ShadowLink** backdoor protocol used in malware that exploited **TP-Link** and **ASUS** routers, including abuse of **`CVE-2024-21833`** to install **microsocks** and maintain SOCKS5 proxy persistence via cron, `rc.local`, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own **CipherForce** operation and activity aligned with the **Vect** ransomware ecosystem; related fallout included **ownCloud** disclosing build infrastructure exposure through **`CVE-2026-33634`** associated with the Trivy compromise.
Jun 29, 2026