How Google Broke TeamPCP From the Inside

For most of 2026, the people trying to defend the open-source ecosystem from TeamPCP were fighting something that behaved less like a hacking crew and more like a chain reaction. Poison a package. Harvest the credentials of every developer who installs it. Use those credentials to poison the next package. Repeat until the blast radius covers a thousand companies. Every time defenders patched one link, the loop had already produced two more.

What almost nobody knew was that the loop had a witness. From roughly March onward, one of the dozen or so accounts with access to TeamPCP’s private planning channel, a room the group called CanisterWorm, belonged to an undercover analyst working for Mandiant, Google’s security subsidiary. Google Threat Intelligence Group researcher Austin Larsen disclosed the operation at the LABScon security conference on Thursday and laid out the details in an interview with WIRED‘s Andy Greenberg beforehand.

The persona had not been built for TeamPCP. It had spent months cultivating a relationship with a single operator in the wider cybercrime scene. When that operator was invited into TeamPCP’s inner circle, the persona was brought along as a trusted associate. By Larsen’s account, Mandiant was reading the group’s internal traffic from close to the beginning of its public run.

The loop, and why patching never caught up

TeamPCP surfaced online in late 2025 and spent the following spring running what amounted to an industrial process. The confirmed victims in the chain read like an inventory of modern developer infrastructure: the open-source container and code scanner Trivy, the LLM gateway LiteLLM, infrastructure belonging to application security firm Checkmarx, the widely used TanStack web libraries, and the enterprise AI platform Mistral AI.

Each compromise fed the next. Malicious code hidden in a popular package ran on developer machines and in continuous integration pipelines, scraped whatever authentication tokens it found, and handed the group publishing rights to the next target. Downstream, that chain reportedly reached GitHub, the data contracting firm Mercor, employee devices at OpenAI, and the European Commission, as well as many organisations that have never been publicly named. More than a thousand companies were breached in total.

At the peak, the group automated the process with a self-propagating worm named Mini Shai-Hulud, after the sandworms in Dune. The name alluded to an earlier Shai-Hulud worm from September 2025 that attempted a similar trick, though it remains unclear whether TeamPCP or its alleged members were involved in that campaign.

The important structural point is that this was never a vulnerability problem. No single CVE sat at its centre. The currency was stolen credentials, and credentials do not get patched.

Revoke first, notify second

Google’s analyst eventually gained access to the server where TeamPCP kept its haul: usernames, passwords, and access tokens, all pulled from victims and staged for extortion. The Australian Federal Police later put the collection at more than half a million credentials.

Larsen’s team faced an arithmetic problem. Contacting every breached organisation individually would have taken weeks that the defenders did not have. So they inverted the usual notification order and went to the platforms where the stolen secrets actually worked, including Amazon Web Services and Microsoft, and pushed for bulk revocation. Hundreds of notification emails went out: providers first, then affected companies. Many came back almost immediately.

That decision is the most transferable part of the whole story. In a credential-driven supply chain attack, the fastest kill switch sits with the identity provider, not with the victim.

An AI-written zero-day, tested and confirmed

The view inside CanisterWorm also revealed something running in parallel with the supply chain campaign. A member of the core group was using an AI tool to develop a zero-day, meaning an exploit for a flaw with no available patch, against a widely deployed login product. The goal was to bypass its two-factor authentication.

Google obtained the exploit code, ran it, and found that with modest modification, it worked. The vendor was notified privately and shipped a fix. Google published the incident as an anonymised case study in May without naming TeamPCP or explaining how it had come by the code.

Machine-assisted exploit development targeting a previously unknown flaw, confirmed to work in the wild, is the part of this story with the longest tail. It suggests the cost of producing a novel authentication bypass has dropped, which has direct consequences for anyone still relying on one-time codes.

Betrayal, and a Google Drive full of evidence

TeamPCP was, by Larsen’s estimate, bad at the business end of crime. Despite the size of the haul, extortion revenue ran to tens of thousands of dollars rather than the millions comparable groups have extracted. To fix that, the group franchised: other crews got access to the stolen credentials in exchange for a percentage of anything they could squeeze out.

One of those partners was ShinyHunters, a long-running and prolific extortion group previously tied to the breach of the education platform Canvas, which disrupted thousands of US schools. Within weeks, ShinyHunters began running its own extortion with TeamPCP’s data and keeping the proceeds. It also mailed Larsen a complete log of the group’s server chat, unprompted, unaware that Google already had a live feed. After the arrests, it sent him a mock law-enforcement seizure banner reading “Operation SkidPCP Completed,” dated 27 August 2026 and stamped with the FBI, AFP, and Mandiant logos. The nickname was an insult, shorthand for script kiddies.

The public taunting got TeamPCP’s attention. The group tightened its circle, moved its data to a new host, and ejected both ShinyHunters and, unknowingly, Google’s analyst.

Old-fashioned tradecraft finished the job. A BreachForums user data leak tied one of the most active CanisterWorm handles to a Gmail address. Forum archives turned up a 2019 dispute over pirated Microsoft Office keys, in which the same pseudonym demanded a PayPal refund routed to an address on a family-surname domain. Then Google learned that the replacement server was being backed up to Google Drive on the same Gmail account. Larsen passed the tip to the FBI and had a response within minutes.

About a month later, after US law enforcement completed the legal process for a warrant, Australian police arrested Ruben Ian Thomson and Louis Michael Gaebler, both in their early 20s, in a joint operation with FBI assistance. Journalist Brian Krebs had independently published his own trail to the same identity. The FBI declined to discuss an active investigation, pointing to its newly published cyber strategy. The AFP declined to comment.

What this signals, and what to do

Larsen stressed that the undercover analyst stayed passive, never participated in intrusions and never encouraged them. That line matters because the operation sits at the edge of what a private company is generally understood to do. Google now has a Cyber Disruption Unit with an explicit mandate to interfere rather than merely observe. As Larsen put it: “Writing reports can only be so useful.”

For engineering teams, the defensive checklist that follows from this case is unglamorous and specific. Retire long-lived personal access tokens in favour of short-lived OIDC-based publishing. Pin dependencies by hash rather than version range. Disable lifecycle install scripts in CI. Scope registry tokens to single packages. Audit which workflows can reach your secrets. And given a demonstrated AI-built 2FA bypass, move privileged accounts to hardware-backed FIDO2 keys.

TeamPCPs’ members lost to a persona, a leaked forum database and their own cloud backup. The infrastructure they exploited has not changed.