Inside TeamPCP: How Google Disrupted a Supply-Chain Campaign From the Hackers’ Core Chat

Google monitored TeamPCP from inside the cybercriminal group while it compromised open-source software, harvested developer credentials and expanded into more than a thousand companies. The access allowed defenders to revoke stolen authentication material, warn victims and obtain working code for an AI-assisted zero-day exploit.

The operation also revealed a fractured criminal ecosystem. TeamPCP partnered with ShinyHunters to monetize its access, only to have the group appropriate stolen credentials, withhold payments and leak TeamPCP’s internal messages.

Two Australians, Ruben Ian Thomson and Louis Michael Gaebler, were subsequently arrested and charged. Authorities described them as principal TeamPCP participants, but the attribution remains an allegation and the specific charges have not been disclosed.

Compromised packages became gateways to the next victim

TeamPCP appears to have emerged publicly in late 2025. Its campaign followed a cascading supply-chain model in which every successful intrusion created opportunities for additional compromises.

The attackers first gained control of an open-source project or software provider. They then inserted credential-stealing malware into the affected software, exposing usernames, passwords and access tokens belonging to developers and downstream users.

TeamPCP could use that authentication material to enter another project, cloud environment or technology company. Malware introduced through the newly compromised software produced another collection of credentials, allowing the cycle to continue.

The campaign affected hundreds of open-source packages and enabled breaches at more than a thousand companies, according to Google’s investigation. Products and organizations caught in the operation included:

• Trivy, an open-source security scanner;
• LiteLLM, an API tool used by AI applications;
• web application security company Checkmarx;
• TanStack, a web application library;
• Mistral AI and its enterprise AI platform;
• GitHub;
• data-contracting company Mercor;
• employee devices at OpenAI;
• employee devices at the European Commission.

Additional victims have not been named. The precise packages, malicious release numbers and affected software versions have also not been disclosed, preventing organizations from relying on a definitive version-based exposure list.

TeamPCP supplemented these intrusions with Mini Shai-Hulud, a self-propagating worm designed to automate expansion across development environments. Its name apparently referenced Shai-Hulud, a separate worm associated with a similar supply-chain technique in September 2025. No connection between TeamPCP, the arrested suspects and that earlier campaign has been established.

An undercover persona entered the CanisterWorm inner circle

A Mandiant analyst reached TeamPCP through an invented online identity. After building trust with someone invited into the organization, the analyst was admitted in March to CanisterWorm, a core chat containing approximately 12 participants.

Austin Larsen of Google Threat Intelligence Group, who is scheduled to discuss the investigation at a SentinelOne LABScon conference, was not the undercover operative.

The analyst avoided participating in attacks, assisting intrusions or encouraging TeamPCP’s members. Instead, the persona communicated only as needed to preserve access and quietly observed the group’s infrastructure, discussions, stolen data and future plans.

That position yielded access to a server holding credentials taken from victims. The collection included passwords, usernames and access tokens captured through the group’s software compromises, along with material apparently being prepared for extortion.

Google faced a containment problem: contacting each credential owner individually would have allowed attackers more time to use the stolen access. Investigators instead approached the providers capable of invalidating large numbers of credentials, including Amazon Web Services and Microsoft.

GTIG sent hundreds of notices to providers and affected organizations. Many recipients acted immediately, allowing credentials and tokens to be revoked before they could support further intrusions.

This provider-first strategy addressed a defining feature of supply-chain incidents. A single stolen developer token can affect repositories, package releases, build systems and cloud resources belonging to several organizations. Revoking it at the service layer can therefore close multiple attack paths at once.

AI helped produce a working two-factor authentication bypass

The internal surveillance exposed another TeamPCP member developing a zero-day exploit against a widely deployed login product. The attacker was using an AI tool to help create code that could bypass the product’s two-factor authentication control.

Google obtained the exploit and tested it. Although researchers had to make several modifications, the code ultimately worked, demonstrating an AI-assisted exploitation attempt against a previously unknown vulnerability during an active criminal operation.

The affected developer was notified and patched the flaw. Google discussed the episode in a case study released in May, but did not identify TeamPCP or disclose that its investigators had recovered the code from the group’s communications.

The product name, vendor, vulnerability identifier and corrected version remain unknown. Consequently, there is no public CVE that organizations can use to track exposure, and no disclosed information establishes whether the flaw appears in CISA’s Known Exploited Vulnerabilities catalog.

Those omissions limit independent verification and targeted remediation. Administrators cannot determine from the available information whether they operate the affected login technology or whether a specific installed version contains the patched code.

The incident nevertheless illustrates a concrete use of AI in offensive development. The tool did not eliminate the need for human modification, but it contributed to code aimed at defeating a critical authentication safeguard.

ShinyHunters turned TeamPCP’s stolen access against it

Despite allegedly holding credentials associated with more than half a million users, TeamPCP struggled to convert access into revenue. Larsen estimated that the group earned only tens of thousands of dollars from extortion, far below the millions obtained by more experienced criminal organizations.

TeamPCP therefore offered other groups access to its credential collection in exchange for a portion of resulting extortion payments. One partner was ShinyHunters, a prolific data-theft and extortion operation.

Around April, several weeks into the arrangement, ShinyHunters began using TeamPCP’s credentials independently and failed to provide the agreed share of the proceeds. It also sent Larsen a complete copy of the messages stored on TeamPCP’s server, apparently unaware that Google already had access through the Mandiant persona.

ShinyHunters publicly mocked TeamPCP on X. TeamPCP reacted by restricting membership, transferring stolen information to another server and removing ShinyHunters and several other participants from CanisterWorm.

The undercover Google identity was expelled as well. TeamPCP’s leaders instructed remaining members not to continue sharing information with ShinyHunters.

The dispute did not end Google’s investigation. It instead forced the operation to shift from direct observation to infrastructure analysis, archived forum records and digital attribution.

Old forum records connected an alias to Ruben Ian Thomson

Leaked BreachForums account data associated one of CanisterWorm’s most active identities with the Gmail address [email protected].

Google searched older forum archives and identified a 2019 dispute involving the “sheepstealing” pseudonym and a seller of pirated Microsoft Office keys. During the disagreement, the user requested a refund to a PayPal account connected to [email protected].

Investigators found another link after TeamPCP moved its credential repository. Information obtained through a trusted partner showed that the new server was being backed up to a Google Drive account associated with [email protected].

Google passed identifying information to the FBI. Larsen said an agent responded within minutes. Approximately one month later, US authorities completed the warrant process necessary to obtain Thomson’s account data from Google.

Australian police subsequently arrested Thomson at a suburban residence. Louis Michael Gaebler was arrested in the same investigation. Both men were in their early 20s, and the Australian Federal Police characterized them as principal TeamPCP participants.

The AFP did not identify them in its public statement because of Australian privacy rules. Neither man provided a comment, and the precise charges were not reported. Journalist and cybersecurity investigator Brian Krebs may also have identified Thomson independently before the arrests.

Defenders should treat developer credentials as incident-wide exposure

Organizations potentially affected by TeamPCP cannot depend on a complete package or version list. Defensive work should therefore focus on credentials, release integrity and the systems used to build and publish software.

Passwords, API keys, repository tokens and cloud credentials exposed on developer workstations should be rotated immediately. Revocation is preferable to password changes alone because long-lived tokens may continue working independently of the user’s password.

Security teams should also inspect:

• source repositories for unauthorized commits, maintainers or release artifacts;
• CI/CD platforms for altered workflows and unknown secrets access;
• package registries for releases created outside normal publishing procedures;
• developer endpoints for credential theft and Mini Shai-Hulud activity;
• AWS and Microsoft environments for sessions created with exposed credentials;
• cloud storage for suspicious backups or synchronization of stolen information.

Compromised developer accounts should be disabled until their activity, authentication factors and connected tokens have been reviewed. Organizations consuming Trivy, LiteLLM, TanStack and other named technologies should verify package provenance, but the absence of disclosed versions means their presence alone does not prove compromise.

Google’s actions formed part of a broader shift toward direct disruption through its Cyber Disruption Unit. Rather than limiting its role to publishing intelligence, the company used its access to invalidate attacker resources, notify providers, protect victims, secure a zero-day patch and support law-enforcement attribution.

The undercover investigation into TeamPCP shows how deeply one stolen developer identity can propagate through modern software distribution. In this campaign, trusted packages were not simply targets. They were the mechanism for reaching the next organization.