A newly identified cloud worm, dubbed PCPJack, is actively targeting exposed cloud infrastructure to steal credentials and remove any artifacts associated with the threat actor group TeamPCP. SentinelLabs researchers discovered the framework, which operates as a credential theft toolset that propagates across cloud environments.
The worm's initial actions involve identifying and deleting tools and processes linked to TeamPCP. This behavior, observed in a script found on April 28, 2026, led researchers to name the tool PCPJack. The framework is designed to harvest credentials from various cloud services, including those related to containers, developers, productivity, and financial operations.
PCPJack targets exposed services such as Docker, Kubernetes, Redis, MongoDB, and RayML, as well as vulnerable web applications. This allows it to spread externally and move laterally within compromised networks. Unlike many cloud-focused malware campaigns that focus on cryptocurrency mining, PCPJack's objectives appear to be centered on credential theft for purposes like fraud, spam campaigns, extortion, or reselling access.
The infection process begins with a Linux shell script named bootstrap.sh. This script sets up the necessary environment, including creating a working directory, checking the public IP against a blocklist to avoid infecting the attacker's own infrastructure, and installing Python 3.6 or later if not already present.
A key function of bootstrap.sh is to remove any artifacts associated with TeamPCP, such as processes, services, or container names. This is followed by the creation of a Python virtual environment and the installation of essential libraries like requests, cryptography, and pyarrow.
The script then downloads six Python modules from an attacker-controlled Amazon S3 bucket. These modules are renamed upon download and include: worm.py (the main orchestrator, also known as monitor.py), parser.py (credential parsing), lateral.py (lateral movement), crypto_util.py (data encryption), cloud_ranges.py (cloud IP database), and cloud_scan.py (cloud port scanner).
Persistence is established by bootstrap.sh. If run with root privileges, it creates a systemd service named sys-monitor.service that executes monitor.py. If not run as root, it sets up two cron jobs to ensure monitor.py is running and restarts it if necessary. Finally, bootstrap.sh self-deletes.
The orchestrator script, monitor.py, drives the toolset. It imports the downloaded modules, which are injected at runtime to ensure all components share the same credential and movement handles. This modular design makes the framework more difficult to analyze in isolation, as the full dependency graph is held only by the orchestrator.
Sensitive strings within the Python modules are stored as hex-encoded blobs and decrypted using a custom XOR function. This function uses the MD5 hash of "urllib3.poolmanager" as a key. However, researchers noted that the Telegram bot token in bootstrap.sh and the credential decryption key in crypto_util.py were not encrypted, indicating some operational security lapses.
The monitor.py script also attempts to blend in by presenting itself as a benign system monitoring utility. It collects system metrics, including information about the types of systems being targeted, which is valuable data for the attacker.
The worm's capabilities include stealing local credentials by executing shell pipelines that target files like .env configurations. The collected data, including success metrics on whether TeamPCP artifacts have been removed from targeted environments, is exfiltrated to the attacker's command-and-control (C2) server.
TeamPCP gained notoriety in early 2026 following its compromise of Aqua Security's Trivy vulnerability scanner, which led to further downstream attacks on projects like LiteLLM. TeamPCP also announced a partnership with the VECT ransomware group. Researchers suggest that PCPJack might be operated by a former TeamPCP member familiar with their tooling, given the overlap in targeted services between PCPJack and earlier TeamPCP/PCPCat campaigns from late 2025.
