Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PCPJack TeamPCP-targeting cloud credential theft campaign

Campaign
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

A new PCPJack campaign is targeting TeamPCP victims by worming across exposed cloud infrastructure, creating a fresh risk of credential theft and unauthorized reuse of cloud access. The framework strips TeamPCP artifacts before moving laterally through the victim environment. It can steal credentials from Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. The activity appears designed for monetization through stolen access rather than crypto-mining.

Related Happenings

TeamPCP opens its offensive framework to copycat supply-chain attackers

Threat Actor Meta
H score60 First: 19.05.2026 07:54 Last: 19.05.2026 07:54 Sources 1

About this happening: TeamPCP has started distributing its offensive framework source code, turning a single supply-chain operation into reusable tradecraft that other threat actors can adopt....

Open Happening

TeamPCP uses Shai-Hulud release to build access-broker monetization pipeline

Threat Actor Meta
H score16 First: 18.05.2026 22:53 Last: 18.05.2026 22:53 Sources 1

About this happening: TeamPCP is being framed as using the Shai-Hulud source-code release to drive an access broker business, turning worm distribution into a credential-monetization pipeli...

Open Happening

TeamPCP campaign expands across multiple victims

Campaign
H score49 First: 15.05.2026 13:54 Last: 15.05.2026 13:54 Sources 1

About this happening: The TeamPCP / Mini Shai-Hulud supply-chain operation is actively compromising hundreds of packages, exposing downstream developers to malware delivery and creden...

Open Happening

Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials

Campaign
H score56 First: 12.05.2026 14:29 Last: 12.05.2026 14:29 Sources 1

About this happening: GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...

Open Happening

TeamPCP Mini Shai-Hulud npm supply-chain campaign

Campaign
H score75 First: 12.05.2026 14:07 Last: 12.05.2026 14:07 Sources 1

About this happening: The TeamPCP-linked Mini Shai-Hulud campaign is an active npm supply-chain operation that steals developer credentials and abuses trusted publishing paths to spread tro...

Open Happening

Timeline

  1. 08.05.2026 12:00 2 articles · 2mo ago

    PCPJack disclosure on TeamPCP victims

    Initial Disclosure

    SentinelOne disclosed PCPJack, a credential theft framework aimed at victims of TeamPCP that worms across exposed cloud infrastructure, removes TeamPCP artifacts, and steals credentials from Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications; the company also recommended using a credential vault or secrets management service, enforcing MFA for service accounts, enforcing IMDSV2 in AWS, allow-listing downloads from approved S3 resources, authenticating Docker and Kubernetes, and applying least privilege to Kubernetes service accounts.

    Show sources
    Open in new tab