Google Threat Intelligence Group researcher Austin Larsen disclosed at SentinelOne's LABScon conference on September 18, 2026, that Google's security subsidiary Mandiant had an undercover analyst embedded in the inner circle of TeamPCP, the crew behind what WIRED describes as the worst software supply-chain hacking spree on record. The persona sat inside a private planning channel the group called CanisterWorm and gave Google visibility into the campaign as it ran, allowing the company to warn targets and interfere with extortion attempts. Victim counts differ across reporting: WIRED and Cyber Kendra put the blast radius at "more than a thousand" companies, while The Meridiem and WebProNews both describe "thousands." No source cited here is a primary victim statement or regulator filing, so every figure below should be read as press or vendor reporting rather than confirmed disclosure.
What Happened
TeamPCP, tracked by Google as UNC6780, surfaced publicly in late 2025 and escalated through spring 2026. Its method, as Cyber Kendra describes it, was a loop: poison a package, harvest the credentials of every developer who installed it, use those credentials to poison the next package, repeat. Defenders patching one link found two more had already been created.
The named downstream compromises vary by outlet and should be treated as a combined, not corroborated, list. WebProNews cites the container and code scanner Trivy, the IaC scanner KICS, the LLM gateway LiteLLM and Telnyx. Cyber Kendra cites Trivy, LiteLLM, infrastructure belonging to application security firm Checkmarx, the TanStack web libraries and the enterprise AI platform Mistral AI. Poisoned packages were pushed to npm, PyPI, Docker Hub and GitHub.
Flare's Emerging Threats Team, publishing August 27, 2026, dates the sharpest phase to five days in March 2026, when a single stolen token let the group poison five software ecosystems, including one package downloaded roughly 95 million times a month. Flare states two people were arrested that day; WIRED, writing in September, says two alleged members were arrested and charged in Australia "last month," which is consistent in timing.
Mandiant's access was, by Larsen's account, opportunistic rather than engineered against TeamPCP. Cyber Kendra reports the persona had spent months cultivating a relationship with a single operator in the wider cybercrime scene; when that operator was pulled into TeamPCP's inner circle, the persona came along as a trusted associate and became one of roughly a dozen accounts with access to CanisterWorm from about March onward. Google also says it received intelligence from ShinyHunters, a criminal group that had partnered with TeamPCP before turning on it, and that it followed operational-security mistakes allegedly made by one of the two accused Australians and passed identifying details to law enforcement.
What Was Taken
The primary stolen asset was credentials, not customer records, which is why no record count exists in this reporting and why readers should be wary of any single number attached to this campaign. TeamPCP's core theft was developer credentials and secrets scraped from public repositories, then registry publishing tokens and CI/CD secrets harvested from machines that installed the poisoned packages.
WebProNews reports that compromises of tools including Trivy, KICS, LiteLLM and Telnyx put hundreds of thousands of downstream users at risk, and cites Wiz's incident response team observing attackers validate stolen credentials, explore cloud environments and exfiltrate data within hours of initial access. Larsen's LABScon disclosure also included the exposure of stolen credential troves held by the group.
One clarification matters here because search results conflate the two events. A separate 2025 incident in which attackers compromised one of Google's own corporate Salesforce instances, retrieving what Google called "basic and largely publicly available business information" on small and medium business customers, is unrelated to TeamPCP. Google did not confirm any breach of Gmail, Google Accounts or Drive in that event, and widely circulated claims of a mandatory warning to 2.5 billion Gmail users were inaccurate.
Why It Matters
Three things make this campaign a break from prior supply-chain incidents.
First, automation of the spread. WIRED reports TeamPCP released a Dune-themed self-spreading worm to automate the poisoning process. Google's 2026 threat accounting names two of the group's malware families, Shai-Hulud and Miasma, and states both are publicly available, with GTIG expecting other actors to copy them. That publication hands unrelated crews a working starting point, so responders should expect these TTPs from operators with no connection to TeamPCP and should price attribution accordingly.
Second, the collapse of setup cost. GTIG reports TeamPCP went from a prompt to a running mass credential-harvesting campaign in under six hours using an AI coding chatbot, one prompt and a set of agent instructions covering planning, building and execution. The Clarity notes an important caveat in GTIG's own framing: the six-hour figure belongs to this criminal crew, while the state-linked activity GTIG documents in the same reporting is mostly LLM assistance to human operators rather than end-to-end automation. Do not read the six-hour number as a general claim about nation-state tempo.
Third, the intelligence model itself. The Meridiem frames Google's infiltration as enterprise security adopting nation-state tradecraft and crossing from reactive defense into offensive intelligence operations. That framing is The Meridiem's editorial read, not a Google claim, and it is worth separating from the operational facts: what Google has actually described is a human source inside a criminal chat room, not intrusion activity against the group.
The Attack Technique
Flare traces the March escalation to a misconfigured GitHub Actions workflow, which yielded a single stolen token that cascaded across five ecosystems and ended with backdoored code sitting inside CI/CD pipelines worldwide. The pattern throughout was credential reuse and trust inheritance rather than novel exploitation.
The group's history runs further back than the supply-chain phase. Infosecurity Magazine reports research published by Oligo Security on August 5, 2026, linking TeamPCP to activity previously tracked as TA-NATALSTATUS between 2020 and August 2025, on the basis of shared domains, malware deployment paths and backend infrastructure. Oligo worked with Mandiant and GitLab on the investigation, and GitLab banned the accounts involved.
The strongest infrastructure link was the domain masscan[.]cloud, present across TA-NATALSTATUS activity, the ShadowRay 2.0 campaign against exposed Ray clusters and later TeamPCP operations. Certificate transparency records date the domain to May 11, 2025, and TeamPCP's own GitHub account later listed it as the group's official website. A compromised Ray cluster logged a download from that infrastructure on July 26, 2025, five months before the TeamPCP name surfaced publicly. The most direct evidence came from GitLab logs: one IP address received reverse shells from a compromised Ray cluster between October 15 and November 2, all shells terminated on November 2, and between November 2 and 4 the ironern440 account authenticated to GitLab from that same address. Oligo also reassessed ShadowRay 2.0, which it had originally attributed in November 2025 to an actor called IronErn440, as TeamPCP activity.
On deanonymization, Flare reports that the group's appetite for publicity worked against it: TeamPCP ran Telegram channels, posted publicly on X, taunted victims and gave a press interview, producing reused handles, avatars and infrastructure references that tied an alias back to a real identity. Flare notes other independent investigations reached similar ground, including work by Brian Krebs.
What Organizations Should Do
- Audit CI/CD workflow permissions now, starting with GitHub Actions. Flare traces the March cascade to a single misconfigured workflow. Eliminate long-lived tokens in favor of short-lived OIDC credentials, and scope every remaining token to the narrowest repository and action set that works.
- Rotate and inventory registry publishing credentials. Require phishing-resistant MFA on npm, PyPI, Docker Hub and GitHub publishing accounts, and treat any developer machine that installed an affected package during the March 2026 window as credential-compromised rather than merely patched.
- Pin dependencies by hash and enforce provenance. Version pinning alone does not stop a poisoned republish. Verify signed provenance attestations where the registry supports them, and stage third-party updates in an internal mirror before they reach build systems.
- Disable install-time scripts in build environments. The harvesting stage depended on code running at installation, so blocking post-install execution and running builds in network-restricted sandboxes breaks the loop at its most reliable point.
- Hunt on the published infrastructure and behavior. Check historical logs for masscan[.]cloud and the associated deployment paths documented by Oligo, and alert on the specific sequence Wiz observed: bulk credential validation followed within hours by cloud enumeration and data egress.
- Assume the tooling outlives the crew. With Shai-Hulud and Miasma publicly available and two alleged members in custody, detections should target the technique rather than the actor. Arrests do not retire a published worm.
Sources: An Undercover Google Analyst Infiltrated a Notorious Supply-Chain H... | TeamPCP Traced Back to 2020 Cryptojacking Operation - Infosecurity... | Google’s Mole Inside TeamPCP: How an Undercover Analyst Watched a S... | Google clocks TeamPCP standing up a mass credential-harvesting camp... | How Google Broke TeamPCP From the Inside - Cyber Kendra | Unmasking TeamPCP: Software Supply Chain Attacks - Flare | Google Crosses Into Offensive Cybersecurity as Mole Infiltrates Tea... | Google Hack Confirmed? What Happened to Salesforce Data and Gmail