Security researchers have discovered an unusual new threat campaign designed to target victims of notorious cybercrime group TeamPCP. PCPJack is a credential theft framework that “worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP,” according to SentinelOne senior threat researcher, Alex Delamotte. TeamPCP is the group behind some major open source supply chain attacks this year, including one that compromised the GitHub Actions for Aqua Security's popular Trivy vulnerability scanner to deliver infostealer malware to countless downstream users including LiteLLM. “Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought…