Two alleged TeamPCP hackers arrested over global supply chain attacks
AFP and FBI arrested two alleged TeamPCP hackers behind open-source supply chain attacks that stole 500,000+ credentials from 1,000+ organizations.
Australian Federal Police, working with the FBI and Western Australia Police, arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah on August 26, 2026, over alleged membership in the TeamPCP cybercrime group. The group allegedly planted malicious code in open-source packages, harvesting credentials, authentication tokens and at least 300 GB of data from over 1,000 organizations, with remediation costs estimated in the hundreds of millions of dollars. TeamPCP has been linked to supply chain attacks on GitHub, Telnyx, LiteLLM, Aqua Trivy, Checkmarx KICS, TanStack, MistralAI and Red Hat using a cloned self-replicating worm dubbed Shai-Hulud. Researchers note TeamPCP cloned the Shai-Hulud worm but was not behind the original 2025 attacks.
- Two Australian men charged with computer offences carrying penalties of 3 to 20 years
- TeamPCP allegedly compromised 1,000+ organizations via poisoned open-source packages
- Over 500,000 credentials and at least 300 GB of data stolen
- Group used a cloned self-spreading Shai-Hulud worm to exfiltrate secrets to public repos
- Aikido researcher says TeamPCP was not behind the original 2025 Shai-Hulud attacks
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Threat actors
- TeamPCP
- Malware
- Shai-Hulud
- Organizations
- AFPFBIWestern Australia Police Force
- Countries
- Australia
From the original article
2 min read at helpnetsecurity.com
Two men from Western Australia have been charged after police allege they were part of TeamPCP, a cybercrime group that planted malicious code in open-source software, then used it to break into organizations around the world. The Australian Federal Police (AFP), working with the FBI and Western Australia Police Force (WAPF), arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah on August 26.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.