PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network

Summary: The threat actor PCPJack hijacked 230 cloud servers on AWS, Google Cloud, and Microsoft Azure, converting business servers across the U.S., Europe, and Asia into SMTP proxies that were verified for mail relay and synced to a downstream consumer every five minutes. Hunt.io found the operation through two unauthenticated open directories on a command-and-control server at 213.136.80[.]73, containing Sliver-integrated SMTP proxy tooling, Chisel tunneling binaries, deployer scripts, and a live Sliver configuration, with the infrastructure still running when discovered.
Bottom line: The verified proxy list was synced every five minutes to a downstream server at 38.242.204[.]245, and someone was consuming it - meaning the delivery infrastructure for spam, phishing, or worse was already operating at scale before anyone noticed.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026