Search/TeamPCP Cloud Stealer
● Malware

TeamPCP Cloud Stealer

The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.

View graph Watch Export
Indicators tracked
0
Intelligence Reports80
80 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
65 relationships
T1560.001: Archive via Utility
source
T1033: System Owner/User Discovery
source
T1613: Container and Resource Discovery
source
T1027.013: Encrypted/Encoded File
source
T1059.007: JavaScript
source
T1548.003: Sudo and Sudo Caching
source
T1074.001: Local Data Staging
source
T1036.005: Match Legitimate Resource Name or Location
source
T1213.006: Databases
source
T1573.001: Symmetric Cryptography
source
T1119: Automated Collection
source
T1003.007: Proc Filesystem
source
T1082: System Information Discovery
source
T1140: Deobfuscate/Decode Files or Information
source
T1555: Credentials from Password Stores
source
T1610: Deploy Container
source
T1580: Cloud Infrastructure Discovery
source
T1552.004: Private Keys
source
T1016: System Network Configuration Discovery
source
T1020: Automated Exfiltration
source
T1609: Container Administration Command
source
T1083: File and Directory Discovery
source
T1049: System Network Connections Discovery
source
T1552.003: Shell History
source
T1552.001: Credentials In Files
source
T1657: Financial Theft
source
T1480: Execution Guardrails
source
T1567.001: Exfiltration to Code Repository
source
T1528: Steal Application Access Token
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1678: Delay Execution
source
T1059.004: Unix Shell
source
T1573.002: Asymmetric Cryptography
source
T1546.018: Python Startup Hooks
source
T1059.006: Python
source
T1555.006: Cloud Secrets Management Stores
source
T1213.003: Code Repositories
source
T1070.004: File Deletion
source
T1546.016: Installer Packages
source
Loading 8 more…