TeamPCP Hackers Exploit CI/CD Pipelines to Steal Cloud Credentials

A financially motivated threat group known as TeamPCP is aggressively targeting modern software supply chains, abusing trusted CI/CD pipelines to steal sensitive developer and cloud credentials at scale.

TeamPCP’s core strategy is simple but highly effective: compromise trusted build and release workflows instead of end-user systems.

By injecting malicious code into CI/CD pipelines, attackers leverage the inherent trust organizations place in automated builds, signed packages, and official registries.

In the Checkmarx KICS incident, attackers simultaneously poisoned Docker images, VS Code extensions, and GitHub Actions workflows.

New research analyzing incidents on April 22 (Checkmarx KICS) and April 24 (elementary-data) reveals a coordinated campaign spanning at least seven waves between March and April 2026, impacting multiple ecosystems including GitHub Actions, PyPI, Docker Hub, and VS Code extensions.

Within hours, they escalated the attack by using stolen npm tokens to hijack the @bitwarden/cli package, demonstrating how quickly stolen credentials can be weaponized.

In contrast, the elementary-data attack required far less effort. A single unsanitized GitHub pull request comment allowed attackers to inject a malicious script into the project’s CI workflow.

Open-source reporting indicates TeamPCP claimed a partnership with the Vect ransomware group and CipherForce.

This triggered the pipeline to build and publish a backdoored package to PyPI and GitHub Container Registry signed and distributed as if it were legitimate.

TeamPCP Hackers Exploit CI/CD

The campaign’s primary goal is credential theft, and its scope is व्यापक. The malware targets:

• GitHub personal access tokens (PATs) and npm tokens.
• Cloud credentials across AWS, Azure, and GCP.
• SSH keys and Kubernetes secrets.
• Infrastructure-as-code files and CI/CD secrets.
• Database credentials and developer configs.
• Cryptocurrency wallet keystores.

In the elementary-data case, the malware went beyond local file theft. It actively queried AWS APIs such as Secrets Manager and SSM Parameter Store to extract sensitive data directly from cloud environments.

This significantly expands the attack’s impact, allowing access to secrets not stored on disk.

Despite consistent objectives, TeamPCP adapts its techniques across attacks. The KICS payload used a large JavaScript stealer executed via the Bun runtime with strong encryption methods like AES-256-GCM and RSA.

Meanwhile, the elementary-data payload used a lightweight Python .pth file that executes automatically when Python starts, avoiding traditional detection.

A notable example is how the elementary-data malware hides its payload using a custom XOR cipher seeded with a Session messenger ID. This same identifier appears across multiple attacks, acting as both a decryption key and a unique threat actor signature.

Another hallmark is attacker “branding” embedded in operations custom HTTP headers, archive names, and even Dune-themed GitHub repositories providing consistent indicators across campaign waves.

TeamPCP’s campaign has impacted at least five programming ecosystems and multiple package registries.

Elementary-data records more than 1.1 million monthly downloads, and the malicious version was live from 22:20:47 UTC on April 24 until sometime on April 25.

Confirmed activity includes compromises involving Trivy, KICS, LiteLLM, Xinference, Telnyx, and Bitwarden CLI, with evidence linking stolen credentials to ransomware operations by the Vect group.

What makes this campaign dangerous is its scalability. By compromising CI/CD pipelines, attackers can automatically infect thousands of downstream users who trust official builds and updates.

These incidents highlight a critical weakness in modern development: over-trusting automation. Even without stealing maintainer credentials, attackers can manipulate workflows to produce legitimate-looking malicious releases.

Organizations using GitHub Actions, PyPI, Docker Hub, or similar platforms should assume exposure if proper safeguards are not in place.

Enforcing least privilege, sanitizing user inputs in workflows, and monitoring unusual API calls such as unexpected access to AWS Secrets Manager are essential steps to reduce risk.

As this campaign shows, in today’s supply chain attacks, the pipeline itself has become the primary target and the most dangerous insider.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.