‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials
A threat actor has launched a campaign to clean up environments infected by the infamous TeamPCP hacking group and deploy its own malicious tools, SentinelOne reports.
Active since late April, the campaign relies on a malware framework targeting credentials across multiple cloud environments and capable of propagating itself.
SentinelOne has named the framework PCPJack, due to its focus on removing from the infected systems any tools and artifacts associated with TeamPCP, the hacking group behind a recent flurry of supply chain attacks targeting multiple open source software ecosystems.
“Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought significant attention to TeamPCP and purportedly led to changes in group membership. We believe this could be a former operator who is deeply familiar with the group’s tooling,” SentinelOne says.
A PCPJack infection, the...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
