PCPJack Credential Stealer Spreads to Cloud Systems

Cybersecurity researchers have revealed details of a new credential theft framework dubbed PCPJack , which targets exposed cloud infrastructure and removes any traces associated with TeamPCP from the environments. “ The tool harvests credentials from cloud, container, development, productivity, and financial services, and then extracts the data through infrastructure controlled by the attackers while attempting to spread to additional hosts , ” SentinelOne security researcher Alex Delamotte said in a report published today.

See also: Apple and Which? in legal battle over iCloud

PCPJack is specifically designed to target cloud services such as Docker, Kubernetes, Redis, MongoDB, RayML , and vulnerable web applications, allowing operators to spread in a worm-like manner, as well as move laterally within compromised networks. The ultimate goal of the cloud attack campaign is to generate illicit revenue for the attackers through credential theft, fraud, spam, extortion, or reselling stolen access.

This activity is notable because it shares significant targeting overlap with TeamPCP, an attacker who rose to prominence late last year by exploiting known security vulnerabilities and misconfigurations in cloud services to join endpoints in an ever-expanding network to conduct data theft and other post-exploit actions.

PCPJack does not include a cryptocurrency mining component, unlike TeamPCP. While it is not known why this profit-making strategy was not adopted, the similarities between the two groups suggest that PCPJack could be the work of a former TeamPCP member familiar with the group’s techniques.

The attack begins with a bootstrap shell script that is used to prepare the environment, configure the payload host, and download subsequent tools, while simultaneously taking steps to infect its own infrastructure, terminate and remove processes or traces associated with TeamPCP, install Python, establish persistence, download six Python scripts, launch the orchestration script, and remove itself.

See also: Serious vulnerabilities in Salesforce Marketing Cloud

The main organizer, worm.py (written to disk as monitor.py), launches specially crafted modules, performs local credential theft, spreads the tool to other hosts by exploiting known flaws, and uses Telegram for command and control (C2). Other scripts include: –

• parser.py (utils.py), for processing credential extraction and categorizing stolen keys and secrets.
• lateral.py (_lat.py), to facilitate identification, collect secrets, and enable lateral movement through SSH, Kubernetes, Docker, Redis, RayML, and MongoDB services.
• crypto_util.py (_cu.py), for encrypting credentials before exporting to the attacker's Telegram channel.
• cloud_ranges.py (_cr.py), to collect IP address ranges assigned to Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Cloudflare, Cloudfront , and Fastly, refreshing the data every 24 hours.
• cloud_scan.py (_csc.py), to perform cloud port scanning for external propagation via Docker, Kubernetes, MongoDB, RayML or Redis services.

The propagation targets for the orchestration script come from parquet files that the worm pulls directly from Common Crawl, a non-profit organization that crawls the internet and provides its files and datasets to the public at no additional cost. “When extracting system information and credentials, the PCPJack operator even collects success metrics on whether TeamPCP has been evicted from targeted environments in a ‘PCP replaced’ field that is sent to the C2,” Delamotte said.

See also: iOS 26.4 adds a handy new iCloud feature

This suggests a direct focus on the attacker’s activities rather than a pure opportunistic attack on the cloud. Further analysis of the attacker’s infrastructure revealed another shell script (“check.sh”) that detects the CPU architecture and downloads the appropriate Sliver binary. It also scans the Instance Metadata Service (IMDS) endpoints and Kubernetes service accounts.