Threat intelligence / Malware

TeamPCP Cloud Stealer

The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) was the primary payload used by [TeamPCP](https://attack.mitre.org/groups/G1056) in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Sysdig TeamPCP MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Google AI Threat Tracker MAY 2026)(Citation: FBI TeamPCP JUL 2026)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) was the primary payload used by [TeamPCP](https://attack.mitre.org/groups/G1056) in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Sysdig TeamPCP MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Google AI Threat Tracker MAY 2026)(Citation: FBI TeamPCP JUL 2026)

Labels

malware

48 recorded

Relationships

uses

Group

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Cloud Infrastructure Discovery

Technique

uses

to Cloud Secrets Management Stores

Technique

uses

to Cloud Service Discovery

Technique

uses

to Code Repositories

Technique

uses

to Container Administration Command

Technique

uses

to Container and Resource Discovery

Technique

uses

to Container API

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials In Files

Technique

uses

Technique

uses

to Delay Execution

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Code Repository

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Financial Theft

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Installer Packages

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Private Keys

Technique

uses

to Process Discovery

Technique

uses

to Proc Filesystem

Technique

uses

Technique

uses

to Python Startup Hooks

Technique

uses

to Shell History

Technique

uses

to Software Discovery

Technique

uses

to Steal Application Access Token

Technique

uses

to Sudo and Sudo Caching

Technique

uses

to Symmetric Cryptography

Technique

uses

to Systemd Service

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

10 external

References

mitre-attack

S9041

SANDCLOCK

—

Aqua Security Trivy Compromise MAR 2026

https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23

Aqua Security Blog Trivy Compromise APR 2026

https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know

FBI TeamPCP JUL 2026

https://www.ic3.gov/CSA/2026/260702.pdf

Google AI Threat Tracker MAY 2026

https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

Wiz Trivy Compromise MAR 2026

https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack

Wiz TeamPCP KICS MAR 2026

https://www.wiz.io/blog/teampcp-attack-kics-github-action

Sysdig TeamPCP MAR 2026

https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions

Palo Alto TeamPCP MAR 2026

https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/