TeamPCP Targets CI/CD Pipelines to Steal Developer Credentials

Severity: High (Score: 69.5)

Sources: Trendmicro, Gbhackers

Summary

TeamPCP, a financially motivated threat actor, has been conducting a campaign targeting software supply chains from March 19 to April 24, 2026. The group exploited trusted CI/CD and release workflows to steal sensitive developer and cloud credentials. Two notable incidents occurred on April 22 and April 24, involving Checkmarx KICS and elementary-data, respectively. The KICS attack utilized complex methods, including simultaneous poisoning of three distribution channels and a downstream npm hijack. In contrast, the elementary-data attack was simpler, requiring only a single GitHub pull request to forge a tagged release commit. The campaign has affected multiple programming ecosystems and registry types, with at least seven distinct waves identified. Attribution to TeamPCP is based on consistent operational markers, but confidence in actor identity remains medium-high. The campaign highlights significant vulnerabilities in CI/CD pipelines and the potential for widespread impact on software development processes. Key Points: • TeamPCP exploited CI/CD pipelines to steal developer and cloud credentials. • The campaign spanned from March 19 to April 24, 2026, with at least seven waves. • Two significant incidents involved complex and simple methods of attack on trusted workflows.

Key Entities

• Data Breach (attack_type)
• Malware (attack_type)
• Supply Chain Attack (attack_type)
• TeamPCP Supply Chain Campaign (campaign)
• Checkmarx (company)
• Elementary (company)
• OpenVSX (company)
• T1041 - Exfiltration Over C2 Channel (mitre_attack)
• T1059.006 - Python (mitre_attack)
• T1071 - Application Layer Protocol (mitre_attack)
• T1195 - Supply Chain Compromise (mitre_attack)
• GitHub (platform)
• Bitwarden CLI (platform)
• PyPI (platform)
• Vect (ransomware_group)
• Bun Runtime (tool)
• Docker (tool)
• GitHub Actions (tool)
• VS Code (tool)