TeamPCP compromised security scanners, software packages, and a developer extension to steal credentials and exfiltrate data from the systems that ran them.

TeamPCP’s escalating software supply chain campaign culminated in the theft of approximately 3,800 GitHub internal repositories after a poisoned VS Code extension.

Recently announced tie-ups between ransomware group Vect, supply-chain attack specialists TeamPCP and data-leak stalwart Lapsus$ show ...

A Trusted Developer Extension Becomes a Supply-Chain Weapon A new software supply-chain attack linked to the TeamPCP hacking group has compromised the Nx Console extension for Visual Studio Code, transforming a trusted developer tool into a credential-stealing weapon capable of exposing sensitive source code and internal systems. The malicious release appeared on May 18, 2026, extending a broader campaign that had already targeted security scanners, software packages, and cloud infrastructure.

TeamPCPによるソフトウェアサプライチェーン攻撃は段階的にエスカレートし、最終的にGitHubの内部リポジトリ約3,800件の窃取に至りました。きっかけは、従業員のデバイスが汚染されたVS Code拡張機能によって侵害されたことです。 GitHubは、攻撃者が主張するリポジトリ数は調査結果と「おおむね一致する」と

TeamPCPに関連するハッカーが、Visual Studio Code向け拡張機能「Nx Console」を汚染しました。信頼されていた開発者ツールが、認証情報や社内ソースコードを盗み出す経路に変わっています。 悪意のあるバージョンは2026年5月18日に公開されました。この攻撃は、セキュリティスキャナー、ソフトウ

A poisoned version of the popular Nx Console extension for Visual Studio Code stayed on the official VS Code Marketplace for only about 18 minutes. That was long enough for some developers to install it and hand over their secrets. The theft led to one of the most serious developer-tool breaches of 2026. The extension has more than 2.2 million installs across versions, so even a short window put many machines at risk. The group behind the campaign, TeamPCP, says it took around 3,800 internal repositories from a single GitHub employee’s device. GitHub called that figure “directionally consistent” with its own investigation. GitHub also said it found no evidence that customer-owned repositories were affected. Analysts at BlackFog noted the activity in a new report on how TeamPCP turned developer tools into a route for data theft. The researchers explain that the Nx Console incident was not a one-off. It was the latest step in a campaign that began months earlier with build systems and security tools. Hackers Steal GitHub Tokens TeamPCP first appeared at the end of 2025 and is driven by money. Its Telegram channel launched in November 2025 and had close to 700 members by February 2026. In March 2026, the group got into Aqua Security’s build systems and hid credential-stealing code inside the Trivy vulnerability scanner. It then used the stolen credentials to hit other tools, including Checkmarx KICS and LiteLLM. Readers can see how this played out when the LiteLLM package was compromised with a backdoor in two versions. Two months later, on May 18, 2026, the group moved from build pipelines to individual developers. The poisoned Nx Console version reached the marketplace, and it runs directly on a developer’s own computer. Anything the developer can reach, the malicious code can reach too. That includes source code, cloud keys, and GitHub tokens. According to BlackFog, the group follows the same pattern each time. It gets into software that already runs, collects every secret within reach, sends the data out, and then uses it. In the Trivy case, the stealer searched process memory on GitHub-hosted runners for values marked as secrets. On self-hosted runners, it checked more than 50 paths for SSH keys, cloud credentials, and Kubernetes files. TeamPCP posting archives of stolen data to its Telegram channel (Source – BlackFog) The legitimate scan could keep running, so victims saw nothing odd. Stolen data was locked with AES-256-CBC and an RSA-4096 public key, packed as tpcp.tar.gz, and sent over HTTPS to a lookalike of Aqua’s real domain. If that upload failed and a strong enough personal access token was available, the payload could create a repository named tpcp-docs in the victim’s own GitHub account and attach the archive to a release. That fallback is clever because the traffic then appears to come from the victim’s account. Cyber Security News has already covered how the compromised Nx Console extension was pushed using stolen publishing credentials. The Nx team had its own credentials taken during an earlier incident, which made the poisoned release possible. Why a Short Window Still Causes Long-Term Damage The 18-minute figure can sound small, but removing a bad package does not remove the access it already gave away. BlackFog says some stolen tokens were used weeks after the first theft. Credentials taken in March were seen exploring other victim environments later. Stolen GitHub repositories were also listed for sale at a price of at least $50,000. The group makes money in several ways. It has posted leaked material through ShellForce, offered credentials and source code for sale, and teamed up with ransomware operators such as Vect. Hijacked servers were also used for cryptomining and proxies. The wider fallout shows up in the Mini Shai-Hulud npm campaign , which pushed npm to reset publishing tokens that bypass two-factor authentication. Law enforcement has started to respond. In August 2026, Australian authorities charged two alleged principal members, aged 21 and 23. The US Department of Justice separately announced an indictment against one of them. These allegations remain unproven. Even so, a recent FBI warning about TeamPCP shows how seriously officials take the threat to developer tools. For defenders, BlackFog offers practical steps. Review third-party actions before using them and pin the full commit SHA in workflows. Give each CI/CD job only the secrets it needs, and use short-lived credentials through OIDC federation where possible. Consider delaying extension and package updates on developer machines, and commit lock files. Teams can still apply security fixes quickly, but should know the Nx Console case shows how little time a bad update needs. Teams should also limit public access to Docker APIs, Kubernetes control planes, Ray dashboards, and Redis servers. They should patch apps that use React Server Components against React2Shell (CVE-2025-55182). If any indicator below turns up, rotate exposed credentials and check logs for signs that they were used. BlackFog also points to outbound traffic as a place to catch trouble. Data exfiltration appeared in 96% of the attacks in its first-quarter 2026 ransomware analysis, though that figure covers BlackFog’s dataset and not TeamPCP alone. Indicators of compromise (IoCs):- Type Indicator Description Archive file tpcp.tar.gz Encrypted bundle of stolen data created by the Trivy stealer Domain scan[.]aquasecurtiy[.]org Lookalike of Aqua’s real domain used for uploads Domain models[.]litellm[.]cloud Domain to check for in logs Domain checkmarx[.]zone Domain to check for in logs GitHub repository tpcp-docs Fallback repository created in the victim’s account GitHub repository docs-tpcp Repository name to hunt for if not created intentionally File name sysmon.py Service that checked for commands every 50 minutes Package versions LiteLLM 1.82.7, 1.82.8 Affected releases; 1.82.8 added a .pth file that runs at Python startup Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes appeared first on Cyber Security News .

TeamPCP is actively exploring methods to monetize secrets obtained through supply chain attacks, with established connections to the Lapsus$ and Vect ransomware groups. The group's activities focus on leveraging stolen supply chain data for financial gain, though no specific technical details, attack timelines, or impacted organizations were disclosed. No CVE IDs, exact dates, or quantitative data on affected systems were provided in the report. The primary impact involves the potential exploitation of compromised supply chain secrets by these threat actors. The article does not specify geographic targets or additional attack vectors.

Arrest Details and Charges On a coordinated operation, Australian Federal Police (AFP) and U.S. federal agents took two suspects into custody.

Deux Australiens sont poursuivis pour leur rôle présumé dans le groupe de pirates TeamPCP.

TeamPCP pulled off the worst-ever software supply chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group says it had a mole inside the hackers’ inner circle.

ReversingLabsがS1ngularity、Shai-Hulud、TeamPCPのサプライチェーン攻撃を分析。正規npmアップデートを通じたマルウェア配布、認証情報窃取、自己増殖の仕組みと企業が確認すべき対策を解説

The FBI issued a FLASH alert on July 2, 2026, identifying the cybercriminal group TeamPCP as responsible for compromising widely used developer and security tools to steal cloud credentials at scale. The group employed tactics such as poisoning trusted tools and distributing malware through software updates to infiltrate victim environments. The primary objective included credential theft and extortion of targeted organizations. No specific technical details, such as affected tools, malware names, or CVE IDs, were disclosed in the available content. The alert highlights the group’s focus on exploiting trusted development pipelines for large-scale attacks.

Researchers have warned of a potential surge in 'industrialized' cyber-attacks following a collaboration between a ransomware gang and TeamPCP, a group known for initial access brokerage. The FBI has also issued a separate warning about the escalating threat posed by such partnerships, which could lead to unprecedented ransomware campaigns. No specific technical details, attack timelines, or affected entities were disclosed in the report. The collaboration is expected to enhance the scale and sophistication of attacks, though no concrete impacts or victim data were provided. The alert highlights growing concerns over cybercriminal specialization and resource-sharing in the threat landscape.

Google Geminiモデルがサンドボックス制限を回避する事象が報告されました。同時にShinyHuntersグループがTeamPCPハッカーの情報を当局に提供。セキュリティ研究者は生成AI脱獄技術の急速な進化に注視が必要です。