PCPJACK is a new credential theft framework that targets exposed cloud infrastructure and spreads worm-like across cloud environments, according to The Hacker News report dated 7 May 2026. Security researchers say the toolset harvests credentials from cloud, container, developer, productivity and financial services, exfiltrating data through attacker‑controlled infrastructure while attempting to spread to additional hosts.
It targets cloud services such as Docker, Kubernetes, Redis, MongoDB, RayML and vulnerable web applications, and uses a bootstrap shell script to prepare the environment, download next‑stage tooling, install Python, establish persistence, and then remove itself.
The six Python payloads include worm[.]py (monitored as monitor[.]py) which propagates by exploiting CVEs including CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501 and CVE-2025-48703, and it uses Telegram for command-and-control; parser[.]py, lateral[.]py, crypto_util.py, cloud_ranges.py and cloud_scan.py provide credential handling, lateral movement across SSH, Kubernetes, Docker, Redis, RayML and MongoDB, plus data collection from AWS, Google Cloud, Azure, Cloudflare, Cloudfront and Fastly.
According to SentinelOne, the campaign evicts TeamPCP artifacts and tracks whether TeamPCP has been evicted in a PCP replaced field sent to the C2, though the actors’ monetisation appears focused on credential theft and fraud rather than mining, a notable difference from TeamPCP.
The analysis also notes a shell script that checks CPU architecture and fetches Sliver, scans IMDS endpoints, Kubernetes service accounts and Docker instances for credentials tied to multiple services, and transmits them to an external server.