TeamPCP Breached 1,000 Companies for 20,000 Dollars While Google Sat in Their Private Chat

Police say a 21-year-old near Perth helped break into a thousand companies and take 500,000 credentials. The victims did nothing wrong. A Google analyst sat in their chat from almost day one.

The Australian Federal Police charged two men from Western Australia on 26 August, after search warrants at three properties. Fourteen offences between them. The police put the damage at more than a thousand organisations, more than 500,000 stolen credentials and at least 300 gigabytes of data, with global cleanup costs running into the hundreds of millions of dollars. Neither man has been convicted, and everything the police say about their role is still an allegation.

What is not in dispute is what one of them said himself. From June until the arrest the 21-year-old was talking to Brian Krebs, and told him he had earned about 20,000 dollars out of it.

How they got in, I wrote about back in April, when the packages were still being poisoned:

• → https://hackingpassion.com/pypi-supply-chain-attack-xinference-teampcp/

The attack works as a loop. Break into the build pipeline of one open source tool, steal the publishing tokens of the developers who use it, use those tokens to poison the next tool, and start again. They did it to a vulnerability scanner, to an infrastructure scanner, to an AI gateway library, and to a telephony SDK, in that order, in nine days. Each round handed them the keys for the round after it.

At the LABScon conference on 18 September, Austin Larsen of Google Threat Intelligence said that one of Mandiant’s undercover personas had been added to the group’s inner circle in March, right as the poisoning campaign started. That inner circle was a private chat of about twelve people. The persona had spent months building trust with someone who was later invited in, and came along with them.

Larsen was clear about the limits. The analyst did not break into anything or encourage a break-in, and said only enough in that chat not to look suspicious.

The persona got access to a server where the group kept its haul: usernames, passwords and access tokens from all those victims, waiting to be used for extortion. Warning each breached company one by one would have taken far too long, given how many there were. So they went to the providers instead, to Amazon Web Services and to Microsoft, and asked them to revoke the stolen credentials at the source. Hundreds of notification emails went out, and many came back with an immediate response.

The first payload ran inside GitHub Actions, the build system that compiles and publishes software. GitHub masks secrets in its logs, so a token that flashes past during a build shows up as asterisks. The script walked around that completely. It read the memory of the runner process directly through /proc/<pid>/mem and pulled the tokens out in plain text. Masking is a display feature, and the values sat in memory regardless.

On the Python side they used a different trick. Into the poisoned version of the AI gateway library went a file called litellm_init.pth. Python reads .pth files automatically when the interpreter starts, so their code ran each time a Python process started on that machine, including the processes that never imported the library at all.

The npm backdoor they shipped is called CanisterWorm, and the name comes from how it takes orders. Instead of phoning a server it polls a canister on the Internet Computer Protocol, a piece of code living on a distributed network, which makes the usual takedown routes useless. The implant sleeps for five minutes after install, then polls that canister at fifty-minute intervals, downloads whatever binary the answer points at, writes it to /tmp/pglog, runs it, and notes the URL in /tmp/.pg_state so it does not fetch the same thing twice. On disk it installs itself as a user service called pgmon, which reads like a PostgreSQL monitoring tool.

It also has an off switch. The implant ignores any URL containing youtube.com. Point the canister at a YouTube link and the infected machines go quiet without a single file being removed, which researchers read as a way to put the implant to sleep.

In May the worm came back in a version that did not need a stolen token at all. Someone opened a pull request from a fork against TanStack’s repository, and that pull request was allowed to write to the build cache of the main project. They poisoned the cache at 11:29 UTC and waited. Almost eight hours later the release workflow ran again, first as a re-run of a job from two days earlier, then thirty-four seconds after that on an ordinary merge by a maintainer. Both runs pulled the poisoned cache back in, and that put the attacker’s code inside the official release job. It scraped a token out of the runner’s memory and exchanged it at npm’s own endpoint, which meant the packages came out carrying npm’s own stamp, the signature that is supposed to prove where a package was built. The supply chain signed them as genuine, because by its own rules they were.

The project’s own publishing step never ran. It was skipped because the tests had failed. The malware minted its own token through the id-token permission, the one a workflow uses to prove to npm that it is who it says it is, and posted the packages straight to the registry: forty-two packages, eighty-four versions, six minutes apart. The official release process never published a thing.

That version also carries a revenge switch. Once a minute it checks whether the tokens it stole have been rotated. The moment they are, it runs rm -rf against the home directory of the machine it is sitting on. Cleaning up is what triggers it.

It persists in two places that survive an npm uninstall: .claude and .vscode, through Claude Code session hooks and VS Code task automation. The tooling developers use to write code has become part of the attack surface, and this campaign targets it on purpose.

That same worm checks the system language before it does anything, and exits quietly if the machine is set to Russian. An earlier version did the opposite with a timezone check: if the clock said Iran, it rolled out a privileged component that wiped Kubernetes clusters, and on machines without a cluster it deleted the files directly.

While the persona sat in the chat, the analysts watched someone in the core group build a zero-day with an AI model. The target was a popular open source web-based system administration tool, and the bug was a two-factor authentication bypass. This was a logic error. A developer had hardcoded a trust assumption into the code that enforces 2FA, so under the right conditions the check was skipped. You still needed valid credentials to use it, and after that the second factor stopped mattering. The researchers took a copy of the exploit, tested it, found it worked with small adjustments, and warned the vendor so it could be patched before the planned mass exploitation run.

The exploit carried a CVSS severity score that the model had simply invented. It was stuffed with educational docstrings, comments explaining the script’s own logic step by step like tutorial material. It had a polished help menu and a tidy ANSI colour class. It was textbook Python, the kind that shows up in training data and almost never in an exploit written by someone who does this for a living.

Charlie Eriksen, a researcher at Aikido who has followed this campaign closely, explained why this is happening now. There used to be a gap between reading the research and turning it into an operation that runs at scale. You had to understand the paper, adapt the code, debug it, build the infrastructure around it, and repeat that for each new target. Language models have closed most of that gap, and what is left is people who can do serious damage without the discipline that used to come with getting that far.

That case study went out on 11 May. Google wrote that it had high confidence the exploit was built with an AI model, the first time it had put that in writing, and it named no group. It took until last week to learn who was behind it, and that the company knew because it was reading their chat.

Once the worm code was public, they turned it into a competition. A thousand dollars in Monero for whoever ran the biggest supply chain operation with it, scored on the weekly and monthly download counts of the packages you managed to poison, with your forum handle and proof of access as the entry ticket. The prize was never the point, and they said so themselves, calling it a participation trophy while announcing they would buy any useful access the entrants produced. Larsen calls the group a peer community of individually skilled actors with one clear centre of gravity, and a contest like that is how a community recruits.

The group fell apart over money. For all that access, extortion was barely paying. So they invited other crews in and offered them the stolen credentials in exchange for a cut. One of those partners was ShinyHunters, who took the credentials, ran their own extortion campaigns and paid nothing back. Then ShinyHunters sent Larsen the complete log of the group’s chat server, unprompted, not knowing there was already a seat in it. The betrayal was loud enough that TeamPCP noticed, moved its data to a new server, shrank the inner circle, and threw out the traitors. The undercover persona lost its access at the same moment.

By then it no longer mattered, because the trail was already in the open.

Larsen found the group’s most active handle in a leaked user database from a hacker forum, registered with a Gmail address. He searched that address across older forum archives and turned up an argument from 2019, in which the same person demanded a refund from a seller of pirated Office keys, to a PayPal account tied to a family domain. And when the group moved its stolen credentials to a new server, that server was being backed up to a Google Drive on that same account. His reaction: there is no way. Why would he send all this stolen material to a Drive that points straight at himself. The tip went to the FBI and an interested agent was on the line within minutes.

Krebs worked from the other end and came out at the same name. Old forum handles linked by the same contact IDs, two more mail addresses, a password reused across accounts, an IP in Perth that had for years been serving up a family’s Synology and QNAP storage devices under their own surname, a brother’s Facebook profile listing the family members, and a domain registered by the father. Then the one that ties it together: a HackerOne bug bounty profile, registered under a full personal name, using the same nickname that multiple security firms had already flagged as an alias of this group. That same person registered companies in Australia. One of them is called OPSEC Express.

Two investigators who were not working together both ended up at one handle that had been in use since 2019: sheepstealing.

The 21-year-old grew up between South Africa and a beach suburb, and talked to that reporter openly for months. He had been homeless, had come out of a detox programme, was two months sober and looking for something to do and people to talk to when he reconnected with old contacts from the malware scene. His own words: blackhatting is fun, there are rewards and incentives to learn and you grow with your team, and without qualifications no employer will even take the time to hear you out. He said he had made about 20,000 dollars and that it was never about the money. Asked whether any of this prepared him for a legitimate job, he said no. He also said that someone like him needs help that prison cannot provide, and two weeks before the arrest he said he was ready to turn himself in.

One of the charges stands out. Next to the computer offences sits a count of failing to comply with a 3LA order, the Australian law that can compel you to hand over your passwords. The passwords did not come. That single count carries a maximum of ten years, longer than the computer intrusion charges themselves. The money laundering count, for proceeds over 100,000 dollars, carries twenty.

Eriksen argues the worm was the best thing to happen to supply chain security, because it forced changes the field had been asking for without success. In late July, GitHub introduced a three-day cooldown for Dependabot, so newly published package versions are not pulled into builds the moment they appear, which gives scanners and maintainers time to spot a poisoned release. Python and several JavaScript ecosystems added the same idea. A loose crew of people in their twenties managed in a few months what years of conference talks had not.

If you maintain packages or run build pipelines, the concrete lessons:

• → Pin your dependencies and your actions to a commit hash, never to a version tag, because tags can be force-pushed
• → Turn on a cooldown so fresh releases wait before they land in your builds
• → Treat build cache as untrusted input, and never let a pull request from a fork write to it
• → Assume masked secrets are readable in process memory, and scope build tokens so a leak buys little
• → Watch the id-token permission, because that is what let the malware publish without the publish step
• → Rotate carefully on a machine you suspect, because the wiper triggers on rotation
• → Check .claude and .vscode in your repositories, because that is where the persistence lives now

The trail that put a name to this group was built out of WHOIS records, old forum posts and a reused email address, not out of exploits. Run whois against a domain you own and map its subdomains, and you will see exactly how much of that kind of trail is sitting in public records. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Australian Federal Police | TanStack | Google Threat Intelligence