TeamPCP Supply Chain Campaign: Update 008 Signals Renewed Technical Offensive and Broader Cybersecurity Challenges

Introduction

TeamPCP, a supply chain threat actor, concluded a 26-day operational pause. Recent weeks have seen a surge in sophisticated attacks across multiple platforms, including npm, PyPI, and Docker Hub. This activity indicates a return to active compromise operations, moving beyond the credential monetization phase seen earlier in April 2026.

These developments show why organizations must constantly maintain strong supply chain risk monitoring and implement effective breach detection methods. A single compromise can cascade across trusted automation, impacting downstream consumers and magnifying potential risks. Analyzing these events provides critical insights into current threat actor methods and systemic vulnerabilities within modern software development ecosystems.

PurpleOps continuously monitors these dynamics, providing cyber threat intelligence platform features to track and contextualize such widespread campaigns. Understanding the intricate details of these attacks is essential for business leaders and security professionals managing a complex threat environment.

What are the latest developments in the TeamPCP supply chain campaign?

The TeamPCP supply chain campaign resumed active operations on April 21-22, 2026, ending a 26-day pause in new package compromises. This operational shift involved three concurrent package compromises across npm, PyPI, and Docker Hub, demonstrating the threat actor's sustained capability. The renewed activity shows TeamPCP retains full operational capacity despite earlier monetization failures.

Checkmarx KICS Docker Hub Compromise

On April 22, 2026, the Checkmarx KICS Docker Hub repository was compromised. Threat actors authenticated using valid Checkmarx publisher credentials and pushed malicious images to the official checkmarx/kics repository.

  • Five existing tags (latest, v2.1.20, v2.1.20-debian, alpine, debian) were overwritten with malicious digests.
  • Two new tags (v2.1.21, v2.1.21-debian) were created containing malicious code.
  • The poisoned KICS binary maintained legitimate scanning functions but incorporated a covert telemetry path.
  • This telemetry path exfiltrated infrastructure-as-code scan output, containing sensitive data like credentials, tokens, and internal topology, to attacker-controlled infrastructure at hxxps://audit.checkmarx[.]cx/v1/telemetry using the User-Agent "KICS-Telemetry/2.0".
  • The incident also involved trojanized cx-dev-assist (versions 1.17.0 and 1.19.0) and ast-results (versions 2.63.0 and 2.66.0) VS Code and Open VSX extensions. These extensions silently downloaded a second-stage mcpAddon.js payload from a backdated commit in the official Checkmarx GitHub repository and executed it via the Bun runtime without integrity verification.
  • TeamPCP publicly claimed responsibility for this compromise via their @pcpcats X account, posting "Thank you OSS distribution for another successful day at PCP inc."

Xinference PyPI Package Poisoning

Also on April 22, 2026, three consecutive xinference PyPI releases (versions 2.6.0, 2.6.1, and 2.6.2) were published from a bot account. The malicious payload was injected directly into init.py, designed for automatic execution upon package import.

  • The payload performed an extensive sweep of sensitive data, including AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials.
  • Exfiltration occurred to hxxps://whereisitat[.]lucyatemysuperbox[.]space/.
  • The payload contained the comment "# hacked by teampcp" and exhibited structural similarities to prior TeamPCP campaigns, such as double base64 encoding, detached subprocess on import, and credential sweeping.
  • However, TeamPCP publicly denied involvement via their X account, characterizing the attack as a copycat using their name and tooling. This introduces analytical complexity regarding attribution.

CanisterSprawl npm Worm Identified

Beginning April 21, 2026, a self-propagating npm supply chain worm, tracked as CanisterSprawl, was identified by Socket and StepSecurity.

  • The worm was embedded across at least 16 malicious package versions within the @automagik, pgserve, @fairwords, and @openwebconcept publisher namespaces. Initial ties were observed to Namastex Labs.
  • Execution occurred via the npm postinstall hook.
  • CanisterSprawl harvested about 40 credential categories through a regex sweep.
  • Exfiltration utilized a dual-channel endpoint, including an Internet Computer Protocol (ICP) canister, mirroring the Command and Control (C2) architecture observed in TeamPCP's CanisterWorm.
  • The lineage resembles TeamPCP-style operations, though a definitive same-actor attribution was not made.
  • The worm has cross-ecosystem capability, designed to jump from npm to PyPI if it identifies a PyPI publish token on an infected host. This indicates a sophisticated multi-platform attack capability. Further information on related software supply chain vulnerabilities is available through PurpleOps analysis.

How did the Checkmarx KICS compromise lead to Bitwarden CLI vulnerability?

The Checkmarx KICS Docker Hub compromise directly cascaded into a downstream compromise of @bitwarden/cli version 2026.4.0 on the same evening. This incident provides empirical evidence of cascading impact within supply chain attacks. Bitwarden's Dependabot automation pulled the malicious checkmarx/kics:latest image into its CI/CD pipeline during the compromised Docker Hub window (April 22, 2026, 14:17:59 UTC to 15:41:31 UTC).

  • The malicious code, present in bw1.js, was included in Bitwarden CLI version 2026.4.0, published to npm between 5:57 PM and 7:30 PM ET.
  • About 334 downloads occurred before detection and removal.
  • The payload contained the string "Shai-Hulud: The Third Coming" and employed Dune-themed identifiers (atreides, fremen, sandworm, sardaukar).
  • It exfiltrated sensitive data, including GitHub tokens, npm tokens, SSH material, AWS/GCP/Azure secrets, GitHub Actions secrets, and AI tooling configuration files, to public GitHub repositories created under victim accounts.
  • Bitwarden subsequently released version 2026.4.1 (a re-release of 2026.3.0) and confirmed no end-user vault data was accessed.
  • This incident illustrates a theoretical risk becoming a demonstrated reality: a compromise of one widely used developer tool automatically infecting another through standard dependency update automation. PurpleOps has previously covered the Bitwarden CLI supply chain attack in April 2024, which provides additional context on such events.

What other significant cyber incidents occurred concurrently?

Beyond the TeamPCP operations, other cyber incidents show the pervasive nature of cyber threat intelligence platform needs. These include a new PyPI infostealer, multiple data breaches linked to ShinyHunters, ongoing exploitation of a Windows Shell vulnerability by a nation-state actor, and others.

Elementary-Data PyPI Infostealer

A malicious version of the popular elementary-data package, 0.23.3, was pushed to the Python Package Index (PyPI), impacting a tool with over 1.1 million monthly downloads. The compromise also extended to its Docker image due to the package's automated workflow.

  • Attackers exploited a GitHub Actions script injection flaw through a malicious comment on a pull request.
  • This flaw exposed the workflow's GITHUB_TOKEN, which was then used to forge a signed commit and tag (v0.23.3), triggering the project's legitimate release pipeline.
  • The pipeline built and published the backdoored package to PyPI and a malicious image to GitHub Container Registry.
  • The malicious release included elementary.pth, which executed automatically to load a secrets stealer.
  • The stealer targeted SSH keys, Git credentials, cloud credentials (AWS/GCP/Azure), Kubernetes, Docker, and CI secrets, .env files, developer tokens, crypto wallet files (Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Monero, Ripple), and system data (/etc/passwd, logs, shell history).
  • Organizations that downloaded elementary-data==0.23.3 or images with tags ghcr.io/elementary-data/elementary:0.23.3 and :latest were advised to rotate all secrets and restore environments.

ShinyHunters Data Leaks

The ShinyHunters threat group continued its activity by posting data linked to Udemy, Zara, 7-Eleven on a dark web site. These claims involved exposed Salesforce records and cloud-based systems, showing the importance of a dark web monitoring service.

  • Udemy Data Breach: ShinyHunters claimed 2.3 GB of data, including over 1.4 million records from Salesforce, containing personally identifiable information and internal corporate data.
  • 7-Eleven Data Breach: The group claimed 12.8 GB of data, including over 600,000 Salesforce records, with personal data and internal business information.
  • Zara Data Breach: ShinyHunters reported 192 GB of data extracted from BigQuery instances, explicitly mentioning Anodot as the entry point. This suggests a third-party connection and potential lateral movement from an earlier incident involving Anodot and Rockstar Games.
  • The group's claims follow a pattern of failed negotiations prior to data publication, a common tactic seen in monitoring underground forums for intelligence. These incidents show the ongoing challenges of brand leak alerts for affected organizations.

Windows Shell Vulnerability Actively Exploited by APT28

Microsoft confirmed active exploitation of CVE-2026-32202 (CVSS score: 4.3), a high-severity spoofing vulnerability in Windows Shell. This flaw was an incomplete patch for CVE-2026-21510.

  • The Russian nation-state group APT28 (also known as Fancy Bear, Forest Blizzard, GruesomeLarch, and Pawn Storm) weaponized CVE-2026-21510 (Windows Shell protection bypass) and CVE-2026-21513 (MSHTML Framework protection bypass) as part of an exploit chain.
  • The campaign, observed in December 2025, targeted Ukraine and EU nations using malicious Windows Shortcut (LNK) files.
  • The exploit uses the Windows Shell namespace parsing mechanism to load a Dynamic-Link Library (DLL) from a remote server via a Universal Naming Convention (UNC) path.
  • The February 2026 patch for CVE-2026-21510 mitigated remote code execution by triggering a SmartScreen check. However, CVE-2026-32202 persisted as an authentication coercion flaw.
  • This vulnerability allowed a zero-click credential theft method. When an LNK file with a UNC path (e.g., \\attacker.com\share\payload.cpl) was parsed, Windows initiated an SMB connection to the attacker's server, triggering an automatic NTLM authentication handshake. This sent the victim's Net-NTLMv2 hash to the attacker, usable for NTLM relay attacks and offline cracking. PurpleOps has published an analysis on Cisco RCE worm risk that touches upon similar supply chain vulnerabilities and worm-like propagation.

North Korean BlueNoroff Group and Fake Zoom Meetings

The financially motivated North Korean threat group BlueNoroff (a subset of the Lazarus nation-state hacking team, also known as APT38, Stardust Chollima, Nickel Gladstone, among other names) has been observed employing sophisticated social engineering tactics involving fake online meetings to target cryptocurrency executives.

  • Victims received seemingly legitimate Calendly invites for "catch-up" meetings, later swapped for typosquatted Zoom or Teams links.
  • Clicking the link led to a self-contained JavaScript application replicating the conferencing software, requesting video and audio access.
  • Fake meeting rooms were populated with "participants" whose video tiles displayed pre-staged media assets, AI-generated still images, deepfake composite video, or other faked media to simulate a live conversation.
  • A subsequent ruse about audio issues initiated a ClickFix-style attack, pushing an "SDK Update" script designed to download second-stage malware.
  • The campaign is self-reinforcing, as captured video footage from victims is repurposed as lures for future targets within their professional networks.
  • Analysis of an intrusion on January 23, 2026, targeting a Web3 figure in North America revealed 100 additional targets, with 80% operating in the cryptocurrency space and 45% being CEOs or founders.
  • Over 80 typosquatted domains were registered from late 2025 through April 2026 for this operation.
  • BlueNoroff's tactics include keyloggers, backdoors, crypto stealers, and other malicious software, with an estimated $2 billion in cryptocurrency stolen in 2025 by DPRK-tied hackers.
  • The Lazarus sub-group TraderTraitor is suspected in the $290 million KelpDAO LayerZero bridge theft in April 2026, an attack on off-chain infrastructure resulting from a failure to use multiple decentralized verifier networks. This shows why real-time ransomware intelligence and live ransomware API feeds are critical for tracking financially motivated threats and their evolving TTPs.
  • Renewed Supply Chain Offensive: The decisive end of TeamPCP's 26-day pause, marked by three concurrent compromises, confirms the group's sustained access and operational capability. The use of valid Checkmarx publisher credentials suggests a successful credential-theft pipeline from prior campaigns, providing access to vendor publishing infrastructure beyond originally targeted ecosystems.
  • Cascading Impact: The Bitwarden CLI compromise, a direct consequence of the KICS Docker image push, demonstrates how automated dependency updates can propagate malicious code across trusted tools. This validates the theoretical risk of exponential impact in campaigns targeting security tooling or core developer utilities.
  • Attribution Complexity: TeamPCP's public claims for the Checkmarx compromise contrasted with their denial of the xinference attack, despite shared operational signatures. This suggests genuine copycat activity, deliberate false flags, or selective claiming of high-prestige compromises.
  • Mainstream Visibility: The technical compromises involving Checkmarx and Bitwarden led to a return of Tier 1 media coverage, aligning with observations that mainstream attention is driven by novel compromises rather than ongoing credential monetization or extortion activities.
  • Monetization Challenges: The continued silence from Vect's leak site and the third consecutive lapsed monetization deadline for TeamPCP-affiliated extortion arms (following ShinyHunters/Cisco and CipherForce/Sportradar) indicates operational constraints for these groups, rather than tactical patience.

Technical Takeaways

  • Compromised publisher credentials for critical developer tools present a significant supply chain risk monitoring challenge, enabling threat actors to inject malicious code into widely used packages and images.
  • Automated dependency management systems, such as Dependabot, can act as vectors for cascading compromises when upstream components are poisoned, requiring rigorous breach detection and integrity verification within CI/CD pipelines.
  • Threat actors employ sophisticated social engineering tactics, including AI-generated deepfakes and typosquatted domains, to facilitate credential theft and malware delivery, particularly targeting high-value individuals in sectors like cryptocurrency.
  • Nation-state actors like APT28 exploit protection mechanism failures (e.g., CVE-2026-32202) to conduct zero-click credential theft via automatic NTLM authentication. This shows the need for strong endpoint and network security configurations.
  • The presence of cross-ecosystem worms like CanisterSprawl, designed to traverse from npm to PyPI, shows the interconnectedness of software registries and the need for full cyber threat intelligence platform features covering multiple development environments.