A Google Threat Intelligence Group analyst named Larsen ran a covert operation to observe the hacker collective TeamPCP, gaining access to a server where the group stored stolen credentials from numerous victim companies. Google used this visibility to rapidly notify cloud providers like AWS and Microsoft to revoke compromised access tokens before the hackers could exploit them for extortion, rather than trying to contact each victim individually.
arstechnica.com
· 2026-09-20
Google’s threat intelligence team secretly embedded an undercover analyst within the hacking group TeamPCP during its extensive supply chain attack campaign. This inside access allowed Google to monitor the group’s activities, warn potential targets, and assist law enforcement in identifying key members. The operation uncovered critical security lapses and contributed to arrests in Australia last month.
wired.com
· 2026-09-18
Threat group ShinyHunters publicly taunted security vendor ReliaQuest, posting screenshots suggesting a compromised employee account and listing the company on its data leak site. ReliaQuest confirmed an employee was tricked via a vishing attack into entering credentials on a fake single sign-on page, but said the attacker only gained view-only access and could not move laterally or reach internal applications.
darkreading.com
· 2026-09-03
The Australian Federal Police announced the arrest of two men from Western Australia on 14 charges related to alleged membership in TeamPCP, a hacking collective linked to widespread supply chain attacks. Authorities say the group's malware, known as Shai-Hulud, spread through compromised open source packages and infected more than 1,000 organizations globally by exploiting CI/CD development pipelines.
arstechnica.com
· 2026-08-28
Australian authorities have arrested two men in Perth accused of belonging to TeamPCP, a hacking group linked to widespread supply-chain attacks on open-source software. The pair face over a dozen charges including hacking, money laundering, and cybercrime offenses, with a court appearance scheduled for Thursday. The FBI says the group compromised more than a thousand organizations and stole over half a million credentials.
techcrunch.com
· 2026-08-27
The Australian Federal Police arrested two men, aged 21 and 23, from Western Australia over their alleged roles in TeamPCP, a group accused of running the longest-running spree of software supply chain attacks. TeamPCP is said to have poisoned hundreds of open-source packages using a self-propagating worm called Shai-Hulud, stealing developer credentials to spread malicious code further. KrebsOnSecurity reports it had identified the 21-year-old suspect months earlier and had been in contact with a person claiming to speak for the group.
krebsonsecurity.com
· 2026-08-27
The Australian Federal Police, working with the FBI and Western Australia Police, arrested and charged a 21-year-old and a 23-year-old accused of belonging to TeamPCP, a hacking collective blamed for injecting malicious code into widely used open-source packages. The group's tampered code allegedly reached over a thousand organizations, including GitHub, OpenAI, Mistral AI, SAP and the European Commission, leading to theft of roughly half a million credentials and exfiltration of at least 300GB of data.
bleepingcomputer.com
· 2026-08-27
GoKawiil