PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB Credentials

A newly identified malware framework dubbed PCPJack is targeting exposed cloud and container infrastructure to steal credentials at scale while actively removing artifacts linked to the TeamPCP threat actor.

Unlike typical cloud-focused campaigns, PCPJack skips cryptomining entirely and instead appears optimized for fraud, spam, extortion, and resale of stolen access.

TeamPCP itself drew attention earlier in 2026 after high‑profile supply chain compromises involving Aqua Security’s Trivy and the LiteLLM AI gateway, and publicly claimed to be collaborating with the VECT ransomware group to monetize stolen cloud data.

PCJACK’s explicit focus on displacing TeamPCPs’ infrastructure and tracking “PCP replaced” metrics in exfiltrated data suggests the author is either a former operator or a rival actor deeply familiar with TeamPCPs’ tooling.

Infections begin with a Linux shell script named bootstrap.sh, which prepares the environment and then pulls a full Python-based framework from attacker‑controlled Amazon S3 storage.

SentinelLABS first spotted PCPJack on 28 April 2026 via a Kubernetes-focused VirusTotal hunting rule, which surfaced a shell script that begins by evicting processes, services, containers, and files associated with TeamPCP before deploying its own tooling.

bootstrap.sh then downloads six Python components – including an orchestrator (worm.py, stored as monitor.py), credential parser (utils.py), lateral movement module (_lat.py), encryption helper (_cu.py), cloud IP range database (_cr.py), and cloud scanner (_csc.py) – and sets up persistence either via a systemd service or cron jobs, depending on privilege level.

The orchestrator injects dependencies into each module at runtime rather than relying on traditional imports, making any individual file appear minimal and hindering static analysis of the full dependency graph.

Sensitive infrastructure details are hex‑encoded and decrypted on the fly using an XOR routine keyed with an MD5 hash of a string resembling a common Python networking library reference, although the operator left a Telegram bot token and some decryption material exposed in other components.

PCPJack Worm framework

Once active on a host, monitor.py launches a broad local collection pipeline that harvests environment variables, .env and configuration files, SSH keys and known_hosts targets, Docker secrets, Kubernetes tokens, AWS metadata credentials, and cryptocurrency wallet files from common filesystem locations.

The script creates a hidden working directory under /var/lib/.spm, checks the host’s public IP against a blocklist to avoid hitting the operator’s own infrastructure, and then aggressively removes processes and artifacts tied to TeamPCP or PCPCat before installing Python 3.6+, building a virtual environment, and loading its payload modules.

The stolen material is parsed by utils.py, which uses extensive regular expressions to identify secrets tied to cloud platforms, enterprise tools, bulk email services, and financial or cryptocurrency providers, reflecting a monetization model centered on spam campaigns, financial fraud, and potential extortion.

For external discovery, PCPJack uses an unusual approach: it pulls Parquet files from the Common Crawl open web corpus and iterates over url_host_name fields to build large, pre‑validated target lists of internet‑facing systems.

Each infected node receives a slice of this dataset based on a seed index, maintains an in‑memory deduplication structure capped in the millions of entries, and then probes candidate hosts for known web vulnerabilities, including the high‑impact React2Shell (CVE‑2025‑55182) issue in React and Next.js deployments.

Successful exploitation leads to the download and execution of bootstrap.sh, enabling PCPJack to spread beyond cloud environments originally compromised by TeamPCP.

PCPJack devotes significant logic to lateral movement across containerized and cloud‑native infrastructure, covering Docker, Kubernetes, Redis, MongoDB, RayML, and SSH.

The lateral.py module runs reconnaissance once per host, then attempts to use Kubernetes service account tokens to query the API server for namespaces, pods, Secrets, and ConfigMaps, exfiltrating credentials and even attempting container escape by mounting the host filesystem into attacker‑controlled containers.

The file check.sh is an 858-line shell script that handles everything before the beacon phones home.

For Docker, the malware checks local and remote Docker sockets, executes its credential‑harvesting routines inside discovered containers, and leverages privileged bind mounts to escape into the underlying host where possible.

Misconfigured Redis instances are abused for key enumeration and a cron‑rewrite persistence trick that re‑launches bootstrap.sh as root every few minutes, while MongoDB and RayML services are scanned on their default ports for unauthenticated access that can yield database contents or allow weaponized job submissions.

SSH‑based propagation rounds out the internal spread by combining discovered keys and hostnames from configuration files and shell history to log into reachable systems and stage the bootstrap script.

PCPJack uses Telegram as its primary command‑and‑control channel, posting host telemetry and credential dumps into one channel while polling another for operator commands embedded in pinned messages, including directives to load new Python modules or reassign Common Crawl ranges for scanning.

Before exfiltration, crypto_util.py attempts to encrypt payloads using ephemeral X25519 key pairs and ChaCha20‑Poly1305 with a hardcoded attacker public key, but falls back to plaintext if its cryptographic dependency is unavailable, leaving some infections’ data exposed in transit.

SentinelLABS also observed a second toolset hosted on the same attacker infrastructure: a large shell script that deploys Sliver C2 beacons compiled for multiple architectures, while simultaneously sweeping cloud and container environments for API keys tied to services such as OpenAI, Anthropic, DigitalOcean, Discord, Grafana Cloud, and HashiCorp Vault.

This toolkit exfiltrates to a typosquatted domain mimicking a major CDN and relies on SSH spraying for last‑mile lateral movement, indicating that the operators are investing in a broader, modular credential theft ecosystem that extends well beyond a single worm.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.