Trend Micro TeamPCP MAY 2026

Mini Shai-Hulud has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.

Mini Shai-Hulud has discovered network configuration through the use of system commands to include `ip addr`, and `ip route`.

Mini Shai-Hulud has used a hybrid AES-256-GCM and RSA OAEP-SHA256 encryption to archive gathered data. Mini Shai-Hulud has also utilized custom MD5-keystream XOR cipher to encrypt data. Mini Shai-Hulud has also been deployed via an obfuscated script using Bun JavaScript runtime.

Mini Shai-Hulud has leveraged commands such as `whoami` to identify the system owner.

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.

TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.

TeamPCP has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.

Mini Shai-Hulud has leveraged JavaScript runtime to execute malicious scripts.

Mini Shai-Hulud has deleted all artifacts to include gathered credential archives to reduce disk persistence and detection.

Mini Shai-Hulud has has exfiltrated data through the use of HTTPS POST requests to C2 domains.

TeamPCP has used compromised credentials for GitHub and software package repositories, including privileged service accounts, to inject malicious code into CI/CD pipelines.

Mini Shai-Hulud has used compromised accounts for Docker Hub and GitHub to publish malicious software packages.

Mini Shai-Hulud has gathered system information of victim hosts through the use of common discovery commands to include `hostname`, `uname-a` and `printenv`. Mini Shai-Hulud has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.

Mini Shai-Hulud has leveraged GitHub commit-search API to recover fallback C2 domains stored in auto-created public Github repositories.

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.

TeamPCP has compromised VS Code and Open VSX IDE extensions.

TeamPCP has conducted coordinated supply chain attacks targeting open-source developer infrastructure including the NPM, VS Code, Docker, and PyPi ecosystems to compromise multiple software packages.

Mini Shai-Hulud has published itself on compromised victim code repositories to propagate malicious versions of packages to other victims.

TeamPCP has used malware to steal access tokens from targeted cloud and developer environments.

Mini Shai-Hulud has stolen application access tokens and other tokens to include those associated with CI/CD.

Mini Shai-Hulud has utilized Python startup hooks to include the .pth import mechanism for execution.

Mini Shai-Hulud has collected credentials stored within configuration files. Mini Shai-Hulud has also gathered credentials from files stored in common credential file paths to include targeting git-credentials, azureProfile.json, and application_default_credentials.json.

Mini Shai-Hulud has gathered unsecured credentials to include SSH private keys within .ssh.

TeamPCP has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.

Mini Shai-Hulud has captured credentials stored in cloud secret stores.

Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.

Mini Shai-Hulud has compressed collected credentials and data within tar archive files prior to exfiltration.

Mini Shai-Hulud has exfiltrated data through the use of the victim’s own GitHub repository by creating a new public repository using a unique naming convention from a curated list of key words or themes.

TeamPCP has registered domains resembling legitimate victim sites such as scan.aquasecurtiy[.]org, checkmarx[.]zone, and git-tanstack[.]com to mask C2 and exfiltration endpoints. TeamPCP has also set up a dark web leak site to post stolen data.

TeamPCP has set up Clouflare Tunnels for malware C2. TeamPCP has also used the session messenger network for decentralized, encrypted exfiltration via  *.getsession[.]org to recipient  ID `05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026`.

TeamPCP has used its own Telegram channel and X accounts @pcpcats and @xploitrsturtle2 for external communications.

Mini Shai-Hulud has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities `kubectl get secrets`.

TeamPCP has engaged in cryptocurrency mining and theft. TeamPCP has also partnered with ransomware and data theft extortion groups, sold leaked code, and crowdsourced supply chain compromises by open-sourcing their Mini Shai-Hulud malware.

TeamPCP has compromised trusted CI/CD pipelines by injecting credential-stealing payloads into legitimate workflows and software packages including open-source security tools Trivy and KICS, and AI gateway LiteLLM.