1. Home
  2. Software
  3. TeamPCP Cloud Stealer

TeamPCP Cloud Stealer

The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.[1][2][3][4][5][6][7][8]

ID: S9041
ⓘ
Associated Software: SANDCLOCK
ⓘ
Type: MALWARE
ⓘ
Platforms: Containers, Linux, macOS, SaaS, Windows
Version: 1.0
Created: 01 July 2026
Last Modified: 31 July 2026

Associated Software Descriptions

Name Description
SANDCLOCK

[7][8]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1548 .003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

TeamPCP Cloud Stealer can use sudo for code execution.[3]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

TeamPCP Cloud Stealer has used curl to upload stolen data to attacker controlled domains.[4][5][6]
Enterprise T1560 .001 Archive Collected Data: Archive via Utility

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.[1][3][4][5]
Enterprise T1119 Automated Collection

TeamPCP Cloud Stealer can identify and collect credentials across over 50 file paths in Cloud, CI/CD, developer tooling, and container enviornments.[1][3]
Enterprise T1020 Automated Exfiltration

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.[1]
Enterprise T1580 Cloud Infrastructure Discovery

TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.[5]
Enterprise T1526 Cloud Service Discovery

TeamPCP Cloud Stealer can search GitHub for Actions runner processes.[3][2][1][5]
Enterprise T1059 .004 Command and Scripting Interpreter: Unix Shell

TeamPCP Cloud Stealer has abused the shell script files entrypoint.sh (in trivy-action) and setup.sh (in ast-github-action/2.3.28) for discovery and credential harvesting.[4] [6]
.006 Command and Scripting Interpreter: Python

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.[1][3][5][5][6]
.007 Command and Scripting Interpreter: JavaScript

TeamPCP Cloud Stealer has infected victims through malicious pre and post-install scripts within the package.json file.[6]
Enterprise T1609 Container Administration Command

TeamPCP Cloud Stealer can use kubectl get secrets to extract credentials from Kubernetes.[3]
Enterprise T1613 Container and Resource Discovery

TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.[3][5]
Enterprise T1543 .002 Create or Modify System Process: Systemd Service

TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.[1][3][5]
Enterprise T1555 Credentials from Password Stores

TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.[2][3][8]
.006 Cloud Secrets Management Stores

TeamPCP Cloud Stealer can enumerate multiple filesystem paths to extract credentials for AWS, GCP, and Azure including Identity Access Management (IAM) credentials.[1][2][3][4][5][5][6][8][7]
Enterprise T1213 .003 Data from Information Repositories: Code Repositories

TeamPCP Cloud Stealer can target sensitive file paths in Git repos to extract credentials.[1][3]
.006 Data from Information Repositories: Databases

TeamPCP Cloud Stealer can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.[3]
Enterprise T1074 .001 Data Staged: Local Data Staging

TeamPCP Cloud Stealer has created a staging file in /tmp for collected data.[5]
Enterprise T1678 Delay Execution

TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.[1][3][5]
Enterprise T1140 Deobfuscate/Decode Files or Information

TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.[3]
Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.[1][2][4][5]
.002 Encrypted Channel: Asymmetric Cryptography

TeamPCP Cloud Stealer has encrypted collected data using a hybrid RSA-4096 and AES-256-encryption prior to exfiltration over 'curl`.[1][2][4][5]
Enterprise T1546 .016 Event Triggered Execution: Installer Packages

TeamPCP Cloud Stealer can inject malicious pre or post-install scripts within package.json for payload execution.[6]
.018 Event Triggered Execution: Python Startup Hooks

TeamPCP Cloud Stealer has used .pth files to establish persistence on compromised hosts due to the Python interpreter's automatic processing of .pth files at startup.[6]
Enterprise T1480 Execution Guardrails

TeamPCP Cloud Stealer has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.[3][5]

Enterprise T1041 Exfiltration Over C2 Channel

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.[1][3][4][5]
Enterprise T1567 .001 Exfiltration Over Web Service: Exfiltration to Code Repository

TeamPCP Cloud Stealer can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.[1][2][3][4][5][6]
Enterprise T1008 Fallback Channels

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to an attacker-controlled domain. If that method fails it can use the victim's own GitHub account to create a public repository and uploads the encrypted data as a release asset.[1][2][3][5][6]
Enterprise T1083 File and Directory Discovery

TeamPCP Cloud Stealer can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.[1][2][3][5]
Enterprise T1657 Financial Theft

TeamPCP Cloud Stealer can search filesystems for cryptocurrency wallets such as Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Ripple, and Monero.[1][2][3]
Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.[5]
Enterprise T1070 .004 Indicator Removal: File Deletion

TeamPCP Cloud Stealer has the ability to remove all staged files after exfiltration.[3]
Enterprise T1105 Ingress Tool Transfer

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.[1][3][5][6]
Enterprise T1036 .005 Masquerading: Match Legitimate Resource Name or Location

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.[5]
Enterprise T1027 .013 Obfuscated Files or Information: Encrypted/Encoded File

TeamPCP Cloud Stealer has used multi-stage payloads with double Base64-encoded scripts to evade static analysis.[1][2][6]
Enterprise T1003 .007 OS Credential Dumping: Proc Filesystem

TeamPCP Cloud Stealer can scrape memory from the Runner.Worker process by reading /proc/<pid>/mem to extract secrets including plaintext tokens.[1][2][3][4][5][6]
Enterprise T1057 Process Discovery

TeamPCP Cloud Stealer can locate GitHub Actions runner processes.[3][1][2][5]
Enterprise T1518 Software Discovery

TeamPCP Cloud Stealer has searched for cryptocurrency wallets on targeted hosts.[1][2]
Enterprise T1528 Steal Application Access Token

TeamPCP Cloud Stealer can read runner.worker process memory to extract plaintext tokens.[6][4][5][6][8][7]
Enterprise T1082 System Information Discovery

TeamPCP Cloud Stealer has detected if it is on a developer machine by checking if the environmental variable  GITHUB_ACTIONS != "true".[1] TeamPCP Cloud Stealer has also identified readable memory regions on CI/CD runners and enumerated system information using hostname and uname-a.[3]
Enterprise T1016 System Network Configuration Discovery

TeamPCP Cloud Stealer has the ability to enumerate network interfaces.[1][3]
Enterprise T1049 System Network Connections Discovery

TeamPCP Cloud Stealer can search compromised systems for webhook URLs connecting to Slack and Discord.[4]
Enterprise T1033 System Owner/User Discovery

TeamPCP Cloud Stealer can use whoami on self-hosted runners to identify the current user.[3]
Enterprise T1552 .001 Unsecured Credentials: Credentials In Files

TeamPCP Cloud Stealer has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.[1][2][3][5][8][7]
.003 Unsecured Credentials: Shell History

TeamPCP Cloud Stealer can target credentials in shell history on self-hosted runners.[3]
.004 Unsecured Credentials: Private Keys

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.[1][2][3][5]
.007 Unsecured Credentials: Container API

TeamPCP Cloud Stealer can query the Kubernetes API for credentials.[5][6]

Groups That Use This Software

ID Name References
G1056 TeamPCP

TeamPCP has used TeamPCP Cloud Stealer in credential harvesting and exfiltration.[1][2][3][4][5][6]

References

  1. McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.
  2. Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.
  3. Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.
  4. Sysdig Threat Research Team. (2026, March 23). TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions. Retrieved July 1, 2026.
  1. McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.
  2. Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.
  3. Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026.
  4. FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.