‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials

A new malware campaign called PCPJack is targeting systems already infected by the notorious TeamPCP hacking group, removing their tools before deploying its own credential-stealing framework. SentinelOne researchers believe this may be a former TeamPCP operator, as the malware targets similar cloud services and systems but focuses on stealing credentials for spam campaigns, financial fraud, and potential extortion. The sophisticated framework spreads by exploiting known vulnerabilities in web applications and cloud services, stealing everything from cryptocurrency wallets to enterprise credentials across platforms like AWS, Kubernetes, GitHub, and Slack.