Update (October 27, 2026): This profile now covers the October LiteLLM pipeline hijack, which LiteLLM has not attributed to any actor, the LAPSUS$ “Chapter II” statement that referenced TeamPCP, and details of the August charges in Australia.
Aliases: PCPcat; activity is also tracked through its CanisterWorm malware
Type: Financially motivated, loosely organized cybercrime group
Attribution: No state links. 2 alleged participants were charged in Western Australia in August 2026
First observed: September 2025
Primary operations: Software supply chain compromise, credential theft, cloud compromise, source code theft, data sales and extortion
Primary targets: Open source packages, CI/CD pipelines, developer tools, AI companies and cloud environments
Status as of October 27, 2026: Disrupted but not dismantled, with the Australian and U.S. investigation ongoing
TeamPCP is a financially motivated cybercrime group that compromises trusted developer tools and open source packages to steal cloud credentials, API tokens, SSH keys and source code from the organizations that use them. A single malicious update can reach thousands of downstream environments.
The group became one of 2026’s most disruptive supply chain threats after a March compromise of the Trivy security scanner cascaded into other widely used projects. In July, the FBI issued its first FLASH advisory dedicated to TeamPCP, and in August, Australian police charged 2 alleged participants.
Latest TeamPCP activity
This timeline covers the last 90 days of developments, including confirmed incidents, law enforcement actions and unverified extortion claims. Earlier events are listed in the coverage archive below.
- October 25, 2026: LiteLLM hit by second supply chain attack as hijacked pipeline ships credential stealer. LiteLLM said a malicious version, 1.107.0, was published on October 21 using a key leaked in May. LiteLLM has not attributed the October attack to TeamPCP or any other actor. Microsoft published an analysis of the malicious package on October 23.
- September 13, 2026: LAPSUS$ “Chapter II” announces return and teases $50B target. The group’s statement thanked TeamPCP. Any cooperation between the 2 groups is unverified, although data from the earlier Checkmarx compromise was published under the LAPSUS$ name.
- August 27, 2026: Australia charges 2 alleged TeamPCP members over global supply chain attacks. The Australian Federal Police, Western Australia Police and FBI arrested a 21-year-old and a 23-year-old after searches on August 26.
- August 12, 2026: CloudSEK estimates the March LiteLLM attack potentially reached more than 2,500 organizations and about 434,000 pipelines. The figures describe potential exposure, not confirmed compromises.
Origins and evolution
TeamPCP was first observed in September 2025, when its activity focused on stealing credentials from cloud-native infrastructure. In March 2026, the group compromised Trivy, and the stolen secrets led to malicious releases of Checkmarx KICS, LiteLLM and the Telnyx Python SDK.
Credentials from the Trivy compromise were used against the European Commission’s AWS environment, and CERT-EU later attributed that breach to TeamPCP. Stolen data was published on the ShinyHunters leak site, and data from the Checkmarx compromise later appeared under the LAPSUS$ name, pointing to a wider ecosystem of groups that share or trade stolen access.
In April and May, the group was linked to the Bitwarden CLI compromise, the Mercor breach and the self-spreading Mini Shai-Hulud worm on npm and PyPI. OpenAI confirmed an internal breach linked to that campaign, while TeamPCP claimed sales of GitHub and Mistral AI repositories that have not been verified.
How TeamPCP operates
TeamPCP targets software distribution channels rather than end users. Observed techniques include:
- Publishing malicious package versions to npm and PyPI after stealing maintainer or pipeline credentials
- Abusing GitHub Actions workflows and other CI/CD automation
- Harvesting cloud keys, Kubernetes secrets, SSH keys and API tokens from developer environments
- Stealing source code and private repositories for sale or extortion
- Reusing stolen secrets to break into cloud accounts long after the original compromise
Researchers and the FBI have linked several malware families to its campaigns. CanisterWorm harvests cloud credentials and tokens, SANDCLOCK extracts AWS credentials, Kubernetes tokens and wallet data, and Mini Shai-Hulud spreads across package ecosystems. Miasma builds on Mini Shai-Hulud techniques to poison development environments.
According to the FBI, the group has also moved into direct extortion by naming victims on a public leak site and working with other cybercriminal groups to monetize stolen access.
Law enforcement actions
The FBI’s July 2026 FLASH advisory described TeamPCP’s supply chain campaigns, malware and indicators of compromise and warned that stolen credentials remain a long-term risk because other actors may reuse them.
In Australia, the AFP said the investigation began in April 2026 after cybersecurity companies shared information with the AFP and FBI. Police allege the 2 men were principal participants and received cryptocurrency payments. The 21-year-old faces 8 charges and the 23-year-old faces 6. The AFP said code linked to the operation potentially compromised more than 1,000 organizations and enabled the theft of more than 500,000 credentials. The charges have not been tested in court, and the investigation is ongoing.
Defensive takeaways
- Pin dependencies and GitHub Actions to verified versions or commit hashes instead of floating tags.
- Rotate every secret that was available to a CI/CD runner or developer machine that installed a compromised package.
- Limit pipeline tokens to the minimum permissions and review publishing keys regularly. The October LiteLLM incident shows how a key leaked months earlier can be reused.
- Watch for unexpected Python startup files and outbound connections from build systems.
- Monitor cloud accounts for new access keys attached to existing users, a technique seen in the European Commission breach.
All TeamPCP coverage
The following archive contains BreachNews reporting related to TeamPCP, from the latest developments backward. Our guide to data extortion explains how stolen data is monetized.
- LiteLLM hit by second supply chain attack as hijacked pipeline ships credential stealer
- LAPSUS$ “Chapter II” announces return and teases $50B target
- Australia charges 2 alleged TeamPCP members over global supply chain attacks
- CloudSEK: LiteLLM supply chain attack potentially impacted over 2,500 organizations
- RapidFort data breach allegedly exposes AWS credentials and internal assets
- FBI issues FLASH warning on TeamPCP supply chain attacks and extortion activity
- The TeamPCP worm may have created a much bigger supply chain problem
- Alleged TeamPCP sale of GitHub internal source code and private repositories
- OpenAI confirms internal breach linked to Mini Shai-Hulud supply chain attack
- TeamPCP claims sale of Mistral AI internal repositories and source code
- Lightning AI repositories allegedly leaked following PyTorch Lightning supply chain incident
- Mini Shai-Hulud malware abuses trusted CI pipelines in expanding supply chain attack
- Bitwarden CLI compromised in TeamPCP supply chain attack targeting developer secrets
- TeamPCP and ShinyHunters named in European Commission breach affecting 30+ EU entities
- TeamPCP supply chain attack hits Mercor, exposing AI training secrets for OpenAI, Anthropic and Meta
- Cisco source code stolen in Trivy supply chain attack compromise
- European Commission confirms cyberattack on AWS cloud infrastructure
Current threat assessment
As of October 27, 2026, TeamPCP remains a significant supply chain threat despite the Australian arrests. The group is loosely organized, and credentials stolen during its 2026 campaigns may still be in circulation among other actors.
Organizations that installed affected Trivy, Checkmarx KICS, LiteLLM, Telnyx, Bitwarden CLI or Mini Shai-Hulud-linked packages should assume exposed secrets are compromised until rotated. The October LiteLLM incident, whatever its source, shows that old leaked keys can enable new attacks.
Attribution and verification
TeamPCP’s claimed data sales and repository leaks are unverified unless confirmed by the affected company. CloudSEK’s figures estimate potential exposure. The October LiteLLM attack has not been attributed to TeamPCP, and cooperation with LAPSUS$ has not been confirmed. The Australian charges are allegations. Everything on this page is alleged unless an affected organization or authority has confirmed it.
Sources and advisories
- FBI FLASH on TeamPCP supply chain attacks (July 2, 2026)
- Australian Federal Police: 2 WA men charged following AFP, FBI and WAPF disruption (August 2026)
- LiteLLM security incident report (October 21, 2026)
- Microsoft: inside the LiteLLM 1.107.0 supply chain compromise (October 23, 2026)
Changelog
- October 27, 2026: Added the October LiteLLM incident with attribution caveats, the LAPSUS$ statement, Australian charge details, a fact box, origins, defensive takeaways and sources. Limited the timeline to 90 days and removed the nation-state tag.
- August 2026: Added the Australian arrests and CloudSEK’s LiteLLM exposure estimate.
- April 4, 2026: Profile published.
