Wiz TeamPCP KICS MAR 2026

TeamPCP Cloud Stealer can scrape memory from the Runner.Worker process by reading `/proc/<pid>/mem` to extract secrets including plaintext tokens.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to an attacker-controlled domain. If that method fails it can use the victim's own GitHub account to create a public repository and uploads the encrypted data as a release asset.

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.

TeamPCP Cloud Stealer can locate GitHub Actions runner processes.

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.

TeamPCP has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.

TeamPCP has queried the Kubernetes API for local service account tokens and has used `kubectl` for lateral movement.

TeamPCP Cloud Stealer has used `curl` to upload stolen data to attacker controlled domains.

TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.

TeamPCP has used compromised credentials for GitHub and software package repositories, including privileged service accounts, to inject malicious code into CI/CD pipelines.

TeamPCP Cloud Stealer can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.

TeamPCP has modified legitimate software binaries to retrieve secondary payloads from C2.

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.

TeamPCP has compromised VS Code and Open VSX IDE extensions.

TeamPCP has conducted coordinated supply chain attacks targeting open-source developer infrastructure including the NPM, VS Code, Docker, and PyPi ecosystems to compromise multiple software packages.

TeamPCP Cloud Stealer has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.

TeamPCP Cloud Stealer can search GitHub for Actions runner processes.

TeamPCP Cloud Stealer can read runner.worker process memory to extract plaintext tokens.

TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.

TeamPCP has used the systemd user service for malware persistence in targeted environments.

TeamPCP Cloud Stealer has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.

TeamPCP Cloud Stealer can query the Kubernetes API for credentials.

TeamPCP Cloud Stealer can enumerate multiple filesystem paths to extract credentials for AWS, GCP, and Azure including Identity Access Management (IAM) credentials.

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.

TeamPCP Cloud Stealer can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid RSA-4096 and AES-256-encryption prior to exfiltration over 'curl`.

TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.

TeamPCP has registered domains resembling legitimate victim sites such as scan.aquasecurtiy[.]org, checkmarx[.]zone, and git-tanstack[.]com to mask C2 and exfiltration endpoints. TeamPCP has also set up a dark web leak site to post stolen data.

TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.

TeamPCP has compromised trusted CI/CD pipelines by injecting credential-stealing payloads into legitimate workflows and software packages including open-source security tools Trivy and KICS, and AI gateway LiteLLM.

TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.