Cybersecurity researchers on Tuesday said a new credential theft framework called PCPJack is targeting exposed cloud infrastructure, stealing data from cloud, container and developer services, and attempting to spread to other hosts in what appears to be a worm-like campaign. A technical analysis from SentinelOne said the toolset also removes artifacts tied to TeamPCP.
KEY FACTS
- Targets Docker, Kubernetes, Redis, MongoDB, RayML and vulnerable web applications.
- Focus Cloud, container, developer, productivity and financial service credentials.
- Method Uses a bootstrap shell script, six Python payloads and Telegram for command and control.
- Overlap Shares targeting patterns with TeamPCP, but does not include a cryptocurrency miner.
- Propagation Pulls target ranges and data from Common Crawl files and scans cloud services for exposure.
The report said the malware begins with a shell script that prepares the environment, installs Python, establishes persistence, downloads follow-on files and removes itself. It then launches modules that handle credential extraction, lateral movement, encryption and external scanning.
According to the disclosure, the orchestration script is written as worm.py and is designed to exploit known flaws including CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501 and CVE-2025-48703. The campaign also uses Telegram channels to receive stolen data.
Researchers said the toolset looks modular and includes separate components for parsing secrets, enabling lateral movement, encrypting credentials, scanning cloud ranges and collecting external targets. Another script, check.sh, selects a Sliver binary based on the host architecture and searches for cloud and service credentials linked to several major providers and applications.
The analysis said PCPJack appears to overlap with TeamPCP, including a field that records whether that group has been displaced from a target environment. It also noted that PCPJack does not deploy miners, unlike TeamPCP, and the motive appears to be credential theft, fraud, spam, extortion or resale of access.
WHY IT MATTERS
The campaign shows how attackers can combine exposed cloud services, public datasets and multiple vulnerabilities to move quickly across environments. The activity can lead to broader compromise when stolen credentials are reused to access additional systems.