Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Summary: Australian Federal Police arrested two men from Western Australia, aged 21 and 23, in connection with TeamPCP, a group blamed for the longest-running spree of software supply chain attacks, which embedded malicious code in hundreds of open source tools and used a self-propagating worm called Shai-Hulud to steal developer credentials. TeamPCP's LiteLLM attack harvested cloud service keys from more than 2,500 organizations, and in May the group claimed credit for compromising at least 3,800 code repositories at GitHub.
What you should know: Two alleged members are in custody, but TeamPCP is described as a peer community of individually skilled actors rather than a single crew, and it ran a $1,000 Monero contest to recruit participants and buy the access their campaigns harvested - so arrests of individuals do not remove the pool of developers whose stolen credentials keep the cycle turning.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026