PCPJack represents a sophisticated credential theft malware campaign first observed on April 28, 2026, targeting global cloud infrastructure with worm-like propagation tactics. This modular credential theft framework specifically targets exposed cloud infrastructure across Linux, Docker, Kubernetes, and major cloud platforms including AWS, Azure, GCP, Cloudflare, and Fastly. The PCPJack malware campaign demonstrates advanced cloud-native attack capabilities, systematically harvesting credentials from cloud services, container environments, developer tools, productivity platforms, and financial services.
The PCPJack attack framework operates by worming across exposed cloud infrastructure and actively evicting artifacts associated with the TeamPCP threat actor before establishing its own persistence mechanisms. Unlike conventional cloud-focused malware campaigns that deploy cryptominers, PCPJack focuses exclusively on credential theft operations, suggesting monetization through credential theft, fraud operations, spam campaigns, extortion schemes, or resale of stolen access credentials. The malware exfiltrates stolen credentials through attacker-controlled Telegram channels, targeting cloud services, financial services, cryptocurrency platforms, enterprise software, and web hosting industries globally.
The PCPJack malware infection chain initiates through execution of a shell script named bootstrap.sh, which functions as the initial dropper on compromised Linux machines. The PCPJack framework establishes a hidden working directory at /var/lib/.spm/ and implements self-protection by checking the victim's public IP address against an operator-maintained blocklist to prevent self-infection. Before deploying its malicious payloads, PCPJack systematically removes processes, services, containers, and file paths associated with TeamPCP and earlier PCPcat campaigns, indicating a deliberate effort to establish exclusive control over already compromised cloud environments.
The PCPJack malware then installs Python 3.6 or later versions, creates a virtual environment, and downloads multiple Python modules from an attacker-controlled Amazon S3 bucket hosted on a typosquatted domain. These modular components provide comprehensive capabilities including orchestration, credential harvesting, lateral movement, encryption operations, cloud IP tracking, and internet-scale scanning functionalities for the PCPJack attack framework.
Once deployed across compromised cloud infrastructure, the PCPJack framework launches monitor.py, which aggressively searches infected systems for sensitive data and exposed secrets. PCPJack harvests .env configuration files, SSH keys, Docker secrets, Kubernetes service account tokens, AWS IMDS credentials, and cryptocurrency wallet information from compromised cloud environments. The malware also scans Git history and environment variables to recover deleted or exposed secrets that remain accessible in cloud infrastructure.
Using regex-based parsing techniques, the PCPJack malware identifies credentials associated with over 30 services, including Binance, Coinbase, Stripe, AWS, GitHub, Slack, Gmail, Twilio, WordPress, and SSH infrastructure. To hinder security analysis, strings embedded within the PCPJack malware are obfuscated through hex encoding and XOR decryption using an MD5-derived key based on the string "urllib3.poolmanager". Stolen credentials are encrypted with X25519 and ChaCha20-Poly1305 before exfiltration through Telegram channels, with silent fallback to plaintext transmission if cryptographic libraries are unavailable.
PCPJack includes extensive lateral movement and propagation capabilities specifically designed for cloud-native and enterprise environments. The Kubernetes module abuses service account tokens to enumerate namespaces and pods, extract secrets, harvest SSH keys, and query AWS metadata services, while attempting container escapes by mounting the host filesystem. The Docker module scans for exposed Docker sockets and APIs on ports 2375 and 2376, enabling PCPJack to enumerate running containers and spread internally across containerized infrastructure.
Additional PCPJack modules target Redis databases, RayML clusters on port 8265, and MongoDB instances on port 27017 for credential theft and persistence operations. The malware framework parses SSH configurations, known hosts files, and bash history to identify additional attack targets and spray harvested credentials across accessible systems to propagate PCPJack infections throughout cloud environments.
For internet-wide expansion operations, PCPJack leverages Common Crawl parquet datasets to generate extensive lists of internet-facing targets. Each infected host receives a specific scanning range assignment, enabling decentralized reconnaissance operations without reliance on centralized command-and-control infrastructure. The PCPJack malware exploits multiple known vulnerabilities including CVE-2025-29927 in Next.js for middleware authorization bypass, CVE-2025-55182 in React2Shell for deserialization-based remote code execution, CVE-2026-1357 in WPVivid for unauthenticated file uploads, CVE-2025-9501 in W3 Total Cache for PHP injection, and CVE-2025-48703 in Control Web Panel for shell injection.
Command-and-control operations for PCPJack are managed through Telegram channels, where infected cloud systems upload stolen credentials and retrieve instructions through pinned messages. Security researchers discovered additional toolkits hosted on the same staging infrastructure, featuring a large shell script named check.sh that deploys Sliver C2 beacons with garble-based obfuscation, steals credentials from services including Anthropic, OpenAI, Discord, and HashiCorp Vault, and exfiltrates collected data to a typosquatted CloudFront domain over ports 443 and 8443.
Immediately upgrade all self-hosted Next.js deployments to fixed versions addressing CVE-2025-29927 to prevent PCPJack exploitation. If patching Next.js is not immediately feasible, strip the x-middleware-subrequest header from all incoming external requests at the load balancer or reverse proxy layer to prevent middleware authorization bypass attacks targeting cloud infrastructure.
Apply the vendor patch for CVE-2025-55182 (React2Shell) across all deployments using react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages. This critical React vulnerability enables unauthenticated remote code execution and is confirmed to be actively exploited in ransomware campaigns and PCPJack attacks.
Upgrade WPVivid Backup & Migration to versions above 0.9.123 to remediate CVE-2026-1357, and upgrade W3 Total Cache to version 2.8.13 or later to address CVE-2025-9501. Both WordPress vulnerabilities allow unauthenticated remote code execution through distinct attack vectors exploited by PCPJack malware.
Apply the patch for CVE-2025-48703 to eliminate the shell injection vulnerability in the filemanager changePerm function. If CentOS Web Panel cannot be immediately patched, restrict network access to the management interface to prevent PCPJack exploitation of vulnerable cloud servers.
Disable IMDSv1 and strictly enforce IMDSv2 with session tokens across all AWS EC2 instances and container workloads. PCPJack actively queries IMDS endpoints to steal cloud credentials, and IMDSv2 enforcement prevents this credential harvesting technique targeting cloud infrastructure.
Ensure Docker daemon sockets on ports 2375/2376 are not exposed to the network without authentication. Require TLS mutual authentication for remote Docker API access. Apply restrictive RBAC policies to Kubernetes service accounts, limiting access to Secrets and ConfigMaps following the principle of least privilege to prevent PCPJack lateral movement.
Segment cloud workloads to limit lateral movement between containerized services, databases, and application servers. Deploy network detection rules for scanning activity on ports 2375, 2376, 6379, 8265, and 27017, which PCPJack uses for internal propagation across compromised cloud infrastructure.
Malicious Domains: cdn[.]cloudfront-js[.]com, lastpass-login-help[.]com, spm-cdn-assets-dist-2026[.]s3[.]us-east-2[.]amazonaws[.]com
IP Addresses: 38[.]242[.]204[.]245, 38[.]242[.]237[.]196, 38[.]242[.]245[.]147, 83[.]171[.]249[.]231, 161[.]97[.]129[.]25, 161[.]97[.]135[.]154, 161[.]97[.]163[.]87, 161[.]97[.]186[.]175, 161[.]97[.]187[.]42, 193[.]187[.]129[.]143, 213[.]136[.]80[.]73
File Hashes (SHA1): 005587975a483876c1fa26b64b418931019be38f, 01cebc48016395e284ac76afc1816f143ee3e7b6, 0b86434ca5145636d745222f7e49c903ce6ef538, 2cd2c5268e41cdece1b0506bcda3b9eba2998119, 2fab324eb0d927846c8744dc0e217beea65138e0, 339cbf61c80f757085c5afb7304d69f323bdf87a, 6060da100b5cd587131a1c11a20d6e0108604744, 848ef1f638807826586802428a7ebafdc710915c, 9c7ab48c9fdbbeecdad8433529bdab38584f0e25, a20a9924d92c2b06d82b79c0fe87451c650cabec, c2dd8051d89c4efa71bd67d2df7d9b4bc3e67810, fed52a4bbac7b5b6ae4f76cab3eadd67e79227e3
Malicious File Paths: /var/lib/.spm/, /etc/systemd/system/spm-worker.service, /tmp/.origin
Malicious File Names: harvest.jsonl
Initial Access: T1190 (Exploit Public-Facing Application)
Execution: T1059.004 (Unix Shell), T1059.006 (Python)
Persistence: T1053.003 (Cron), T1543.002 (Systemd Service)
Defense Evasion: T1027 (Obfuscated Files or Information), T1036.005 (Match Legitimate Name or Location), T1070.004 (File Deletion)
Credential Access: T1552.001 (Credentials In Files), T1552.005 (Cloud Instance Metadata API), T1552.007 (Container API)
Discovery: T1046 (Network Service Discovery), T1613 (Container and Resource Discovery)
Lateral Movement: T1021.004 (SSH), T1610 (Deploy Container)
Collection: T1119 (Automated Collection)
Exfiltration: T1567 (Exfiltration Over Web Service)
Command and Control: T1102.002 (Bidirectional Communication), T1071.001 (Web Protocols)
Resource Development: T1583.006 (Web Services)
SentinelOne Labs - Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
HivePro Threat Advisory - Next.js Under Siege as CVE-2025-29927 Opens the Floodgates for Attackers
HivePro Threat Advisory - React2Shell Flaw in React Server Components Under Active Attack
HivePro Threat Advisory - TeamPCP Automated Supply Chain from Trivy to LiteLLM in a Multi-Ecosystem Breach
