Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
58
Malware
CanisterWorm
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenAug 27, 2026
- Last mentioned28d ago
Timeline
3 articles · newest firstAutonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
72
Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
68
Appears with
- TeamPCPthreat actor · 3
- Trivyproduct · 2
- SANDCLOCKmalware · 2
- GitHubproduct · 1
- Miasmamalware · 1
- Western Australia Police Forceorganization · 1
- Google Threat Intelligence Grouporganization · 1
- UNC6780threat actor · 1
- FBIorganization · 1
- Aqua Securityvendor · 1
- Claudeproduct · 1
- Mustang Pandathreat actor · 1
- LiteLLMvictim · 1
- Basin Castlethreat actor · 1
- Telnyx Python SDKproduct · 1
- Australian Federal Policeorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.