Post

Threat actors are in a turf war for ownership of your infrastructure. @sentinellabs.bsky.social has uncovered PCPJack, a predatory cloud credential worm that hunts its own kind. Its first move? A scorched-earth eviction of rival group TeamPCP.

SentinelOne

@sentinelone.com

7 May

This isn’t a theory—it’s in the code. PCPJack specifically kills TeamPCP processes and even reports a "PCP replaced" metric back to its C2.

SentinelOne

@sentinelone.com

7 May

What PCPJack does after it wins the turf war:

SentinelOne

@sentinelone.com

7 May

🔑 Steals cloud credentials across AWS, Kubernetes, Docker, Slack, GitHub, Stripe, and 30+ other services 🌐 Propagates externally using Common Crawl parquet data — a legitimate web archive nonprofit — as its target list

SentinelOne

@sentinelone.com

💀 Deploys Sliver C2 beacons via a second toolset, compiled with garble obfuscation to defeat signature detection 🚫 Zero cryptomining. None. In a world where every cloud worm drops XMRig eventually, this one doesn't. It's going straight for credential monetization, extortion, and fraud.

7/5/26, 5:07 pm0 reposts0 likes

SentinelOne

@sentinelone.com

7 May

The cloud attack ecosystem is developing competitive dynamics as it evolves. Full analysis by @sentinellabs.bsky.social researcher @alex.leetnoob.com: s1.ai/pcpjack

s1.aiPCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at ScaleCloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potential extortion.