FBI Says TeamPCP Uses Trojanized Updates to Steal Cloud Tokens, SSH Keys, and Kubernetes Secrets

The Federal Bureau of Investigation (FBI) has issued an urgent FLASH advisory warning that the cybercriminal group TeamPCP is weaponizing trojanized software updates to harvest cloud access tokens, SSH keys, and Kubernetes secrets at scale.

This campaign represents one of the most sophisticated software supply chain attacks observed in 2026, exploiting trust in widely deployed developer and security tools to establish persistent access across thousands of enterprise environments.

TeamPCP’s attack methodology centers on compromising trusted software distribution channels by injecting malicious code into legitimate packages, creating a cascading effect where credentials stolen from one victim enable compromise of downstream targets.

Between February and May 2026, the threat group successfully modified critical tools including Trivy, KICS (Checkmarx Infrastructure as Code scanner), LiteLLM, and the Telnyx Python SDK access all commonly integrated into enterprise CI/CD pipelines, cloud infrastructure, and security workflows.

The trojanized Trivy appeared to function normally while secretly harvesting AWS, GCP, and Azure credentials, Kubernetes service account tokens, SSH keys, and Git authentication material from CI/CD runners.

Credentials exfiltrated from Trivy victims were then leveraged to compromise subsequent targets including KICS, LiteLLM, and Telnyx SDK, creating a trust inversion where security tools themselves became attack vectors.

According to ic3 gov, the attack chain began with the compromise of Aqua Security’s Trivy vulnerability scanner on March 19, 2026, where attackers force-pushed malicious code to 76 of 77 release tags and distributed backdoored binaries through official channels.

TeamPCP has deployed a multi-component malware toolkit designed for comprehensive credential harvesting and persistence.

TeamPCP Uses Trojanized Updates

CanisterWorm operates as a cross-ecosystem supply chain worm targeting npm and PyPI registries, while SANDCLOCK functions as a specialized credential stealer extracting AWS credentials, Kubernetes ServiceAccount tokens, environment variables, and cryptocurrency wallet data.

The Mini Shai-Hulud campaign represents a self-replicating worm that propagates across open-source registries, with its Miasma variant specifically engineered to self-propagate while poisoning configuration files and harvesting credentials.

The primary payload, dubbed “TeamPCP Cloud Stealer,” dumps the Runner.Worker process memory to capture secrets injected through GitHub Actions’ secret-handling mechanism, then sweeps filesystems for SSH keys, cloud provider credential files, Kubernetes configurations, Docker registry credentials, and LLM API keys including OPENAI_API_KEY and ANTHROPIC_API_KEY.

All harvested material is encrypted using AES-256 with RSA-4096 wrapped keys before exfiltration to attacker-controlled infrastructure, with researchers estimating over 300 GB of data and 500,000 credentials potentially exfiltrated.

The FBI recommends immediate rotation of all CI/CD secrets, publishing tokens, and cloud credentials accessible during identified exposure windows, particularly for organizations that used compromised tool versions between March 19-24, 2026.

GitHub Actions workflows to verified commit SHA hashes rather than floating version tags, which can be silently redirected to malicious code as demonstrated in this campaign.

Organizations should search GitHub repositories for ‘tpcp-docs’ or ‘docs-tpcp’ named repositories created by the worm using stolen credentials, enforce least-privilege permissions on all CI/CD service accounts, and implement runtime behavioral monitoring for pipelines to detect unexpected outbound connections.

Additional hardening measures include requiring phishing-resistant multi-factor authentication for all accounts with code repository or package registry publishing access, maintaining offline immutable backups of critical repositories, and implementing minimum package age thresholds (e.g., 7 days) to reduce exposure to newly published malicious versions.

The FBI emphasizes that organizations impacted by this campaign must treat exfiltrated data and credentials as persistent risks, as affiliated threat actors including the Vect ransomware group are likely to weaponize stolen credentials long after initial compromise.

IOCs

Category	Value
IP Addresses	83.142.209.11
	45.148.10.212
	83.142.209.194
	83.142.209.203
	94.154.172.43
	67.217.57.240
Domains	scan.aquasecurtiy[.]org
	checkmarx[.]zone
	checkmarx[.]zone/vsx
	checkmarx[.]zone/static/checkmarxutil-1.0.4.tgz
	checkmarx[.]zone/raw
	models.litellm[.]cloud
	tdtqy-oyaaa-aaaae-af2dqcai.raw.icp0[.]io
	check.git-service[.]com
	t.m-kosche[.]com
	git-tanstack[.]com
	recv.hackmoltrepeat[.]com
	audit.checkmarx[.]cx/v1/telemetry

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.