Mercor — Cyber Attacks, Breaches & Threat Activity

Threat entity extracted from intelligence sources

Frequency
11
occurrences
First Seen
April 1, 2026
Last Seen
May 7, 2026

Mercor is an organization tracked by ThreatCluster, appearing in 4 threat clusters built from 11 intelligence report mentions.

Mercor is a organization tracked across 4 threat clusters and 11 intelligence report mentions on ThreatCluster. First observed April 1, 2026; most recent activity May 7, 2026.

Related Threat Clusters

  • Mercor Cyberattack Linked to LiteLLM Supply Chain Compromise

    AI recruiting startup Mercor confirmed it was impacted by a supply chain attack linked to the LiteLLM project, which has affected thousands of organizations. The breach was attributed to the hacking group TeamPCP, with…

    30 articles · Updated April 1, 2026
  • Checkmarx Data Leak Linked to Supply-Chain Attack by TeamPCP

    Checkmarx, a software security firm, is investigating a significant data leak after its GitHub repository was compromised in a supply-chain attack on March 23, 2026. The attack, attributed to the TeamPCP cybercrime…

    12 articles · Updated April 27, 2026
  • Anthropic's Claude Mythos Preview Sparks Cybersecurity Revolution

    Anthropic has announced the launch of Project Glasswing, utilizing its unreleased AI model, Claude Mythos Preview, to identify and exploit thousands of critical software vulnerabilities across major operating systems…

    1350 articles · Updated April 7, 2026
  • PCPJack Malware Targets TeamPCP Victims for Credential Theft

    The newly discovered PCPJack malware framework is actively targeting cloud environments to steal credentials while removing remnants of the TeamPCP cybercrime group. This worm exploits exposed services such as Docker,…

    11 articles · Updated May 7, 2026

Recent Intelligence Reports

  • Hackers hack victims hacked by other hackers — Techcrunch · May 7, 2026
  • The EU built the world's most comprehensive AI regulation. It does not give Europe access ... — Thenextweb · May 4, 2026
  • Ongoing supply-chain attack 'explicitly targeting' security, dev tools — Theregister · April 27, 2026
  • Ongoing supply-chain attack 'explicitly targeting' security, dev tools — Theregister · April 27, 2026
  • AI recruiting biz Mercor says it was 'one of thousands' hit in LiteLLM supply — Theregister · April 2, 2026
  • AI Recruiting Platform Mercor Targeted in Supply Chain Cyberattack via Compromised ... — Mlq.Ai · April 1, 2026
  • Mercor confirms cyberattack as hackers claim 4TB of critical data in possession — Cybernews · April 1, 2026
  • AI startup Mercor confirms security incident linked to LiteLLM supply chain attack — Scworld · April 1, 2026

Frequently asked questions

What is Mercor?

Mercor is an organization tracked by ThreatCluster, appearing in 4 threat clusters built from 11 intelligence report mentions.

Is Mercor still active?

The most recent intelligence report mentioning Mercor on ThreatCluster is dated May 7, 2026. Activity was first observed April 1, 2026, giving a tracked span from then to May 7, 2026.

What is Mercor associated with?

Across ThreatCluster reporting, Mercor most frequently co-occurs with UNC1069, Data Breach, Malware, Phishing, Ransomware, among 12 tracked related entities.

What are the latest developments involving Mercor?

The most significant recent cluster is “Mercor Cyberattack Linked to LiteLLM Supply Chain Compromise” (30 articles · Updated April 1, 2026). Mercor appears across 4 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on Mercor?

Mercor appears in 11 intelligence report mentions across 4 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown