Critical Vulnerability in Microsoft DurableTask Python Client Lets Attackers Execute Code

Key Takeaways

• The TeamPCP threat group compromised three versions of Microsoft’s official DurableTask Python client.
• Versions v1.4.1, v1.4.2, and v1.4.3 of the durabletask package on PyPI contained a sophisticated, multi-cloud credential-stealing worm.
• The attack leveraged a compromised GitHub account and a stolen PyPI publishing token to inject malicious code directly into the official repository.
• The malware targets Linux systems, exfiltrating credentials from AWS, Azure, GCP, Kubernetes, and various password managers, then propagates laterally.
• PyPI has quarantined the affected versions, but organizations using these specific releases must take immediate mitigation steps.

A persistent cybercrime syndicate, known as TeamPCP, has once again demonstrated its prowess in supply chain attacks, successfully injecting a multi-cloud credential-stealing worm into Microsoft’s official Python client for the Durable Task workflow execution framework. This incident marks a significant continuation of the group’s aggressive 2026 campaign targeting developer ecosystems.

Security researchers at Wiz identified that specific versions of the durabletask package – v1.4.1, v1.4.2, and v1.4.3 – hosted on PyPI, were compromised with a sophisticated worm-like malware payload. Following Wiz’s detailed analysis, PyPI swiftly quarantined all three affected versions to prevent further infections.

TeamPCP’s Relentless Supply Chain Campaign

TeamPCP, also known by the monikers PCPcat and DeadCatx3, has established itself as one of the most prolific supply chain threat actors throughout 2026. Their ongoing campaign, internally codenamed “Mini Shai-Hulud,” commenced in early March with the compromise of Aqua Security’s Trivy scanner. This initial breach then cascaded into a series of attacks targeting prominent platforms and libraries, including Checkmarx GitHub Actions, LiteLLM, Telnyx, and numerous npm packages.

More recently, the group executed a widespread compromise on May 19, 2026, affecting over 300 packages within the @antv npm ecosystem. Wiz Research highlighted in a report that the attack on the durabletask client occurred just days after the group’s compromise of guardrails-ai on May 11, with the infection chain directly linked to the earlier @antv wave.

Attack Vector and Malware Evolution

Investigators traced the durabletask compromise to a GitHub user account previously implicated in the @antv incident. This account was observed targeting the microsoft/durabletask-python repository between 15:08 UTC and 15:16 UTC. During this critical eight-minute window, the attacker meticulously copied a legitimate commit message from the main branch to obscure their malicious activities.

The attacker had gained unauthorized access to the GitHub account through a prior operation, subsequently exfiltrating GitHub Secrets from repositories accessible to that account. Crucially, among these stolen secrets was a PyPI publishing token. This token granted the attackers direct authorization to push malicious releases to the official PyPI registry, entirely bypassing standard code review processes and safeguards.

The malware deployed in this incident, named rope.pyz, represents a direct evolution of transformers.pyz, which was previously used in the guardrails-ai compromise. This sophisticated payload specifically targets Linux systems and strategically injects itself across multiple entry points: task.py, entities/__init__.py, extensions/__init__.py, and payload/__init__.py. This multi-point injection strategy provides the malware with a significantly increased number of execution paths compared to its earlier iterations.

Credential Theft and Lateral Movement Capabilities

Upon execution, the rope.pyz malware initiates a comprehensive credential theft operation, targeting a wide array of sensitive information, including:

• AWS IAM credentials, Azure service accounts, and GCP tokens.
• Kubernetes service accounts and HashiCorp Vault tokens.
• Credentials from popular password managers like Bitwarden, 1Password, and pass/gopass, which are brute-forced using harvested passwords.
• Shell history files (.bash_history, .zsh_history) to uncover additional embedded secrets.

Beyond data exfiltration, the worm demonstrates robust propagation capabilities. It leverages AWS SSM (Systems Manager) and Kubernetes for lateral movement, enabling it to spread to as many as five additional targets per infected host, significantly expanding the scope of a breach.

The command-and-control (C2) infrastructure supporting TeamPCP’s operations has also matured. The group has shifted from raw IP addresses to domain-based servers, utilizing check.git-service.com as its primary C2, with t.m-kosche.com serving as a backup. Notably, SSL verification is now enabled for C2 communications, enhancing the malware’s stealth and resilience.

Indicators of Compromise

Organizations should immediately investigate their environments for the following indicators:

• C2 Domain (Primary): check.git-service[.]com
• C2 Domain (Secondary): t.m-kosche[.]com
• Payload File: /tmp/rope-*.pyz
• Infection Marker (General): ~/.cache/.sys-update-check
• Infection Marker (K8s): ~/.cache/.sys-update-check-k8s
• Hash – rope.pyz: 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce
• Hash – durabletask-1.4.1.whl: 7d80b3ef74ad7992b93c3196662612e4e2ceb93e7727cdbd1d2a9af47d44ba8
• Legacy C2 IP: 83.142.209.194

What You Should Do

Organizations potentially affected by this compromise must take immediate and decisive action:

• Immediate Search and Audit: Scrutinize all lockfiles and CI/CD logs for any installations or dependencies on durabletask versions 1.4.1, 1.4.2, or 1.4.3. On Linux hosts, search for the presence of /tmp/rope-*.pyz.
• Check for Infection Markers: Look for the existence of the ~/.cache/.sys-update-check directory and active processes running python3 /tmp/managed.pyz to confirm payload execution.
• Rotate All Credentials: Assume compromise for all AWS IAM keys, Azure and GCP service accounts, Kubernetes service accounts, HashiCorp Vault tokens, and any passwords stored in Bitwarden or 1Password. Initiate a full credential rotation immediately.
• Audit Cloud and Kubernetes Activity: Review AWS CloudTrail logs for suspicious SSM:SendCommand calls and Kubernetes audit logs for any unexpected kubectl exec activity, indicative of lateral movement.
• Block C2 Infrastructure: Implement blocks at the DNS and proxy levels for check.git-service[.]com and t.m-kosche[.]com. Additionally, block outbound network traffic to the /v1/models, /audio.mp3, and /api/public/version endpoints associated with the C2 communication.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.