Listen to this Post
Introduction
A newly discovered malware framework named PCPJack is rapidly becoming one of the most aggressive cloud-focused threats seen in recent months. Unlike traditional malware campaigns that quietly steal credentials or deploy ransomware, PCPJack takes things a step further by actively removing competing threat actors from already compromised systems. Researchers discovered that the malware specifically targets traces of TeamPCP, a notorious cybercrime group known for multiple high-profile supply-chain attacks against developer ecosystems and cloud infrastructure.
Security researchers from SentinelLabs describe PCPJack as a sophisticated credential-stealing platform built for large-scale operations across Linux-based cloud environments. The malware aggressively targets exposed services including Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. Once inside a network, it spreads laterally, harvests credentials, establishes persistence, and attempts to monopolize access to infected systems by wiping out competing malware infections.
The campaign highlights a growing trend in cybercrime where attackers are no longer only fighting defenders, but also fighting each other for exclusive control of valuable infrastructure. PCPJack appears designed not just for infiltration, but for domination.
PCPJack Targets Exposed Cloud Infrastructure
According to SentinelLabs researchers, PCPJack primarily infects Linux-based cloud servers using a malicious shell script known as bootstrap.sh. Once executed, the malware creates hidden directories, installs Python dependencies, downloads additional modules, and launches its primary orchestrator component called monitor.py.
During the infection phase, PCPJack performs a highly unusual action. It scans the compromised environment for TeamPCP-related tools, services, containers, persistence mechanisms, and malware artifacts. Everything connected to TeamPCP is then deleted from the system. This effectively allows PCPJack operators to seize full control of compromised infrastructure without interference from rival cybercriminals.
Researchers believe this behavior strongly suggests a connection between PCPJack and TeamPCP’s earlier campaigns. The similarities in tactics, targeting methods, and infrastructure indicate that PCPJack may have been developed by a former TeamPCP member or affiliate who split from the group and launched an independent operation.
SentinelLabs explained that many of the targeted services closely resemble those used during TeamPCP and PCPCat campaigns that surfaced in late 2025. Those attacks gained significant visibility after a series of supply-chain breaches involving Aqua Security’s Trivy scanner, malicious PyPI packages like LiteLMM and Telnyx, and compromised SAP npm packages.
Because of these overlaps, researchers suspect that PCPJack’s operators possess deep familiarity with TeamPCP’s tooling and operational methods.
Massive Credential Theft Operations
The main purpose of PCPJack appears to be large-scale credential theft across cloud-native environments and developer ecosystems.
The malware harvests credentials from a wide range of sources, including:
Docker environments
Kubernetes clusters
Redis and MongoDB databases
SSH private keys
Slack tokens
WordPress configuration files
OpenAI API keys
Anthropic API keys
Discord credentials
DigitalOcean accounts
Financial services and messenger platforms
After collecting credentials, PCPJack encrypts the stolen information using X25519 ECDH encryption combined with ChaCha20-Poly1305 encryption. The encrypted data is then divided into small chunks and exfiltrated through Telegram channels while respecting Telegram’s message size limitations.
This encryption method makes interception and forensic analysis significantly more difficult for defenders. The use of Telegram as an exfiltration channel also allows attackers to receive stolen data quickly and anonymously from anywhere in the world.
Researchers believe the stolen credentials are likely monetized through several cybercriminal channels, including:
Credential resale markets
Financial fraud operations
Spam campaigns
Extortion schemes
Unauthorized cloud resource abuse
Exploitation of Critical Vulnerabilities
PCPJack propagates by scanning public cloud infrastructure for exposed and vulnerable services. Once targets are identified, the malware attempts exploitation using multiple recently disclosed vulnerabilities.
The campaign currently exploits the following vulnerabilities:
CVE-2025-29927
Authentication bypass vulnerability affecting Next.js middleware through crafted headers.
CVE-2025-55182 (“React2Shell”)
A dangerous Server Actions deserialization flaw impacting React and Next.js applications.
CVE-2026-1357
Unauthenticated file upload vulnerability in WPVivid Backup plugin.
CVE-2025-9501
PHP injection vulnerability in W3 Total Cache through cached mfunc comments.
CVE-2025-48703
Shell injection flaw affecting CentOS Web Panel’s Filemanager permission functionality.
In addition to internet-wide scanning, PCPJack downloads hostname datasets from Common Crawl parquet files to expand its list of potential targets. This dramatically increases its scanning scale and enables continuous discovery of exposed infrastructure.
Once inside a compromised environment, PCPJack begins harvesting SSH keys, enumerating Kubernetes clusters, scanning Docker daemons, and attempting execution on internal systems reachable from the infected machine.
Persistence and Lateral Movement
Persistence mechanisms used by PCPJack are designed to survive reboots and administrator intervention.
The malware establishes persistence through:
Systemd services
Cron jobs
Redis cron rewrites
Privileged containers
These methods ensure that the malware can maintain long-term access even after partial remediation attempts.
PCPJack also demonstrates strong lateral movement capabilities. By abusing harvested SSH credentials and cloud orchestration tools, the malware spreads deeper into internal networks. Kubernetes clusters and Docker environments are especially vulnerable because many organizations still expose management interfaces without proper authentication or network segmentation.
Researchers additionally discovered a Sliver-based backdoor hosted on the attackers’ infrastructure. Variants exist for x86_64, x86, and ARM architectures, allowing the malware to operate across multiple cloud server types and embedded environments.
What Undercode Say:
PCPJack represents a major shift in modern cybercrime operations because it demonstrates how financially motivated attackers are evolving into ecosystem predators rather than isolated threat actors. Traditionally, malware families focused on persistence and monetization while quietly coexisting with other infections on compromised systems. PCPJack changes that model entirely by actively removing rival attackers and claiming exclusive ownership of infected infrastructure.
This behavior mirrors organized criminal territory wars in the physical world. In cybercrime, access to cloud infrastructure is extremely valuable because compromised servers can be used for credential theft, botnets, crypto mining, spam delivery, phishing infrastructure, proxy networks, or secondary attacks against enterprise targets. By removing TeamPCP infections, PCPJack operators ensure that stolen credentials and computational resources belong only to them.
Another important aspect is the malware’s focus on cloud-native technologies. Kubernetes, Docker, Redis, and MongoDB are deeply integrated into modern enterprise infrastructure. Many organizations still prioritize rapid deployment over security hardening, leaving exposed APIs, weak authentication, and unpatched services available to attackers.
The targeting of OpenAI and Anthropic API keys is also extremely notable. AI infrastructure has become highly valuable to cybercriminals because stolen AI credentials can be abused for automated phishing, malware development, content generation, social engineering, and evasion research. This indicates that attackers are adapting rapidly to the AI economy.
The use of Common Crawl datasets for reconnaissance demonstrates industrial-scale automation. Instead of relying on manual target discovery, PCPJack continuously harvests internet-wide hostname data to feed its scanning engine. This creates a scalable infection pipeline capable of identifying thousands of vulnerable systems quickly.
Another concerning detail is the exploitation of modern web framework vulnerabilities involving React and Next.js. These technologies power a massive portion of modern SaaS and startup ecosystems. Attackers are clearly investing in exploits targeting developer-centric infrastructure because developers often maintain elevated access to production environments, cloud keys, CI/CD pipelines, and sensitive repositories.
The malware’s cleanup routine targeting TeamPCP also reveals something psychologically important about cybercriminal ecosystems. Threat actors increasingly distrust each other, leading to fragmentation, internal rivalries, and operational splits. Former affiliates leaving major groups often retain insider knowledge, tooling familiarity, and infrastructure intelligence, making them especially dangerous.
PCPJack’s encrypted Telegram exfiltration strategy also highlights how legitimate platforms continue to be weaponized for cybercrime. Telegram’s accessibility, automation support, and anonymity make it an attractive command-and-control and exfiltration channel for threat actors globally.
Defenders should also pay close attention to the persistence mechanisms used by the malware. Systemd services, cron jobs, and privileged containers are common administration tools in Linux environments, meaning malicious activity can blend into normal operational noise. This makes detection far more difficult unless organizations implement behavior-based monitoring and cloud workload protection.
The presence of Sliver implants further elevates the seriousness of this campaign. Sliver is a modern post-exploitation framework often used in advanced intrusions because it supports flexible payload delivery, stealth communication, and cross-platform operations. Its integration into PCPJack infrastructure suggests mature operational planning rather than opportunistic attacks.
One of the biggest lessons from this campaign is that exposed cloud services remain one of the most dangerous attack surfaces in cybersecurity today. Even organizations with strong endpoint security frequently neglect cloud configuration management, identity segmentation, and API authentication.
This malware also demonstrates how cybercriminal operations increasingly resemble legitimate software businesses. PCPJack includes modular architecture, automated propagation, encrypted communication, persistence engineering, and multi-platform compatibility. Modern malware development now mirrors enterprise DevOps practices.
Security teams should consider cloud security posture management, workload isolation, runtime threat detection, MFA enforcement, and secret rotation as mandatory defenses rather than optional enhancements. Hardcoded secrets, plaintext credentials, and exposed orchestration panels are becoming direct entry points for advanced automated malware ecosystems.
The rise of malware like PCPJack suggests that the next generation of cyber threats will be heavily automated, cloud-native, AI-aware, and designed for continuous self-propagation across interconnected infrastructure.
Fact Checker Results
✅ SentinelLabs researchers did confirm that PCPJack removes TeamPCP artifacts from infected systems to monopolize access.
✅ The malware actively targets Docker, Kubernetes, Redis, MongoDB, WordPress environments, and exposed cloud infrastructure.
❌ There is currently no public evidence directly proving PCPJack is officially operated by former TeamPCP members, although researchers consider it highly likely based on behavioral similarities.
Prediction
🔮 PCPJack-style malware frameworks will likely inspire copycat operations focused on cloud-native infrastructure warfare between rival cybercriminal groups.
🔮 AI platform credentials and cloud orchestration environments may become primary high-value targets for future automated malware campaigns.
🔮 Organizations relying heavily on exposed Kubernetes and Docker services without strict authentication controls could face a major wave of automated compromises over the next 12 months.
🕵️📝Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
