The 2026 TeamPCP campaign represents a major shift in cybersecurity, moving away from simple malware delivery toward the sophisticated exploitation of trusted software identities. Malicious logic embedded in containerized environments sought out secrets across multiple namespaces in an attempt to escalate from a single compromised container to full cluster-level control. This operation demonstrated that merely removing malicious files is not enough to stop a breach when the underlying digital privileges remain in the hands of an attacker. By analyzing the path from the security tool Trivy to the library LiteLLM, a clear picture emerges of how modern hackers turn the software supply chain against itself. The core of this strategy involved moving fluidly between different layers of the development process, exploiting the inherent trust users place in popular open-source tools to infiltrate private environments and steal sensitive data. This campaign highlights a dangerous new reality where security scanners, designed to protect organizations, are transformed into engines for harvesting administrative credentials. By compromising the automation systems that build and test software, the attackers gained access to high-level secrets that are usually hidden from the outside world.
The Genesis and Persistence of the Breach
Initial Intrusion: Identity Persistence in Trivy
The campaign began by exploiting a specific vulnerability in the GitHub repository for Trivy, a popular vulnerability scanner used by millions of developers to secure their container images and infrastructure code. This initial gap allowed the attackers to steal both organizational and repository-level secrets, giving them a foothold inside the development environment that would prove difficult to dislodge. Although the maintainers attempted to rotate these credentials shortly after discovery, the cleanup was incomplete, leaving at least one valid automation token in the hands of the hackers. This oversight was critical because it allowed the adversaries to maintain a presence within the system even as security teams believed the threat had been neutralized. The attackers demonstrated a keen understanding of how modern development platforms manage permissions, specifically targeting the tokens that govern automated workflows rather than human-accessible accounts. By focusing on these non-human identities, they avoided many of the traditional multi-factor authentication triggers that might have alerted the team to unauthorized access earlier in the intrusion process.
The Revolving Door: Failure of Credential Rotation
This failure created a revolving door effect where the attackers could use surviving identities to access newly created secrets as they were generated by the development team. Because the invalidation of credentials did not happen simultaneously across all platforms, TeamPCP was able to remain inside the release environment for weeks, silently observing the remediation efforts. By the time the second wave of activity was detected, it was clear that the intruders had successfully survived the first attempt to kick them out of the system. This persistence was not achieved through advanced malware, but through the strategic use of legitimate administrative tools that the attackers had effectively hijacked. The ability to stay hidden within a trusted environment meant that every new security key or access token generated by the victims was immediately compromised upon creation. This created a cycle of insecurity where the very acts intended to restore safety actually provided the attackers with fresh materials to extend their reach into other connected services and cloud environments.
Global Credential Harvesting through CI/CD Pipelines
Weaponizing Workflow: The CI/CD Attack Surface
Once their hold on the Trivy environment was secure, TeamPCP shifted their focus to active data collection by inserting malicious code into the tool’s automated workflow. This code was designed to run on the systems of any organization using Trivy to scan their own software for vulnerabilities, essentially turning the security tool into a Trojan horse. Because the malicious logic executed before the actual security scan began, users were completely unaware that their environment was being searched for sensitive information during what they believed was a routine safety check. The attackers exploited the fact that continuous integration pipelines are often granted high levels of privilege to perform their duties, such as pulling code from private repositories or deploying to production servers. By piggybacking on these legitimate processes, TeamPCP ensured that their data collection scripts operated with the full authority of the target organization’s automation systems. This allowed the attackers to bypass the standard security boundaries that usually separate development, testing, and production environments.
The Scale of Harvesting: Targeting Cloud and Container Secrets
The scale of this credential harvesting was massive, affecting hundreds of thousands of potential software pipelines across numerous organizations. The attackers specifically targeted secrets like SSH keys, cloud provider tokens for AWS and Azure, and Kubernetes configurations that were stored as environment variables. By focusing on the systems where software is built, TeamPCP bypassed traditional security layers and waited for credentials to be loaded into memory during legitimate work processes. This method was particularly effective because it did not require the attackers to break into each individual organization’s network; they simply waited for the victims to run the compromised security tool on their own infrastructure. The sheer variety of credentials harvested allowed the attackers to build a comprehensive map of the global software infrastructure, identifying high-value targets for future exploitation. This phase of the operation proved that the automation layer of the modern enterprise is often the most vulnerable point of failure, as it acts as a central hub for all the secrets required to run complex, cloud-native applications.
The Strategic Pivot to LiteLLM
Exploiting Stolen Publishing Privileges: The Power of Tokens
The transition from compromising Trivy to attacking LiteLLM was made possible by the theft of software publishing credentials during the earlier stages of the campaign. These specific keys are among the most powerful assets in a development lifecycle because they allow a user to release new versions of a package to the public through official repositories. Through the poisoned Trivy scanner, the attackers gained visibility into the environment variables of other projects, eventually capturing PyPI and Docker tokens that belonged to the maintainers of the LiteLLM library. This move confirmed that the ultimate goal of the CI/CD harvesting was to gain the ability to distribute software through official channels that are trusted by default. Unlike phishing or social engineering, which target individuals, this approach targeted the very infrastructure of trust that the global developer community relies upon. By obtaining these tokens, the attackers essentially became the legitimate maintainers of the library in the eyes of the automated systems that manage software distribution and installation.
The PyPI Contamination: Inheriting a Trusted Identity
Within days of obtaining these tokens, the attackers released an unauthorized version of the LiteLLM library, which was quickly picked up by automated dependency managers worldwide. By inheriting the identity of a trusted publisher, TeamPCP ensured that their malicious code would be automatically downloaded by thousands of developers and automated systems without any manual intervention or warning. This move was particularly devastating because LiteLLM is widely used in artificial intelligence and machine learning applications, which often handle highly sensitive data and have extensive access to compute resources. The attackers used their stolen identity to mask the malicious changes within a sea of legitimate code updates, making it nearly impossible for a human reviewer to spot the intrusion at a glance. This demonstrated a deep understanding of the “release-early, release-often” philosophy of modern software development, where the speed of updates often outpaces the ability of security teams to thoroughly vet every change. The contamination of a trusted library showed that the supply chain is a single point of failure for thousands of downstream users.
Evolution of the Malicious Payload
Advanced Execution: Targeting the Local Developer Environment
As the campaign moved into the LiteLLM ecosystem, the technical nature of the attack became more aggressive and automated, moving beyond simple data theft to active system compromise. In earlier versions, the malicious code required a user to manually run a specific part of the library to trigger the payload, providing a small window for detection if the user was observant. However, later versions introduced a special file that forced the code to execute automatically whenever the Python interpreter started, regardless of how the library was being used. This shift targeted the local workstations of developers rather than just server-side build systems, aiming to compromise the primary machines used to write and test code. By infecting the developer’s local environment, the attackers could gain access to even more sensitive information, such as personal keys, internal documentation, and unreleased source code. This expansion of the attack surface showed that TeamPCP was not satisfied with just server-side secrets but wanted to control the entire lifecycle of software creation from the initial keystroke to the final deployment.
Detection via Failure: The Fork-Bomb Discovery
During this stage, a technical error in the attacker’s code caused a fork-bomb effect, where a computer would repeatedly restart the malicious process until it completely ran out of resources and crashed. While this likely hurt the attacker’s ability to stay hidden, it served as a primary clue for security researchers to identify the breach and begin a formal investigation into the anomalous behavior. The crash reports from developers around the world provided the first tangible evidence that something was wrong with the latest version of the library. If the attackers had been more careful with their code, the breach might have gone undetected for months or even years, allowing them to continue harvesting data in total silence. This accidental discovery highlights the delicate balance attackers must maintain between staying hidden and achieving their operational goals. For the security community, the fork-bomb served as a loud alarm that eventually led to the discovery of the broader TeamPCP infrastructure and the eventual reclamation of the stolen publishing identities that had powered the entire campaign.
Broadening the Scope and Final Implications
Persistence Mechanisms: Establishing a Hidden Presence
After achieving execution on a victim’s system, the payload attempted to establish a permanent presence through various means to ensure the attackers could return even after a reboot. On Linux systems, it tried to install a hidden service disguised as a system monitoring tool, complete with names and descriptions that looked legitimate to an untrained eye. In containerized environments, the code specifically looked for ways to gain control over entire Kubernetes clusters by seeking out privileged access tokens across different namespaces. The malware was programmed to recognize the specific structure of modern cloud-native environments, allowing it to move laterally from a single infected container to the underlying host or adjacent services. This level of environmental awareness suggested that TeamPCP had spent significant time researching how organizations architect their cloud infrastructure. By establishing these persistence mechanisms, the attackers ensured that their impact would be felt long after the initial malicious library version was removed from the official repositories.
Strategic Lessons: Securing the Automation Layer
The TeamPCP campaign served as a stark reminder that the modern software supply chain was only as secure as its most privileged identities. It was recognized that focusing on patching software was no longer enough; organizations had to shift their focus toward securing the automation identities that managed the software delivery process. Security teams were urged to implement strict credential rotation policies and adopt zero-trust principles for CI/CD pipelines to ensure that no single token could compromise an entire ecosystem. The event proved that if an attacker could steal the master keys to a trusted delivery system, they could bypass almost every traditional defense in place. Moving forward, the industry adopted more robust signing mechanisms for software packages and more transparent auditing of automated workflows. These steps were taken to ensure that the identities of publishers and tools remained verified at every step of the process. Ultimately, the lessons learned from this breach helped redefine how digital trust was managed, leading to a more resilient infrastructure that prioritized identity security over simple perimeter defense.
