PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB Credentials

Gbhackers •Mayura Kathir • May 8, 2026

A newly identified malware framework dubbed PCPJack is targeting exposed cloud and container infrastructure to steal credentials at scale while actively removing artifacts linked to the TeamPCP threat actor. Unlike typical cloud-focused campaigns, PCPJack skips cryptomining entirely and instead appears optimized for fraud, spam, extortion, and resale of stolen access. TeamPCP itself drew attention earlier in 2026 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PCPJack Malware Targets TeamPCP Victims for Credential Theft The newly discovered PCPJack malware framework is actively targeting cloud environments to steal credentials while removing remnants of the TeamPCP cybercrime group. This worm exploits exposed services such as Docker, Kubernetes, Redis, and MongoDB, propagating through compromised cloud infrastructures. SentinelLabs identified PCPJack on April 28, 2026, noting its capability to evict TeamPCP's tools and install its own credential theft modules. The malware is designed for large-scale credential theft and monetizes its operations through fraud, spam, and extortion, without deploying cryptocurrency mining functions. The attack vector involves a shell script named bootstrap.sh that establishes persistence and downloads additional modules for credential harvesting. Affected organizations are urged to implement robust cloud security practices to mitigate risks. The scope of impact includes various cloud, container, developer, and financial services, with significant implications for organizations relying on these platforms. 11 sources 70

Extracted Entities

PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB Credentials

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)