TeamPCP Hackers Exploit CI/CD Pipelines to Steal Developer and Cloud Credentials

Key Takeaways

• The TeamPCP hacking group is actively exploiting CI/CD pipelines to steal sensitive developer and cloud credentials.
• The attacks involve injecting malicious code into trusted development tools and components, including Docker images, VS Code extensions, and GitHub Actions workflows.
• Over seven distinct waves since March 2024, the group has successfully compromised Checkmarx KICS and the elementary data Python package.
• Stolen credentials are being used for extortion, with ransomware groups publishing victim data.
• Organizations should implement strict least privilege principles, egress filtering, and thorough auditing of CI/CD environments to mitigate risks.

TeamPCP Leverages CI/CD to Pilfer Cloud and Developer Credentials

The cybercriminal organization known as TeamPCP has been observed orchestrating a sophisticated campaign to compromise continuous integration/continuous delivery (CI/CD) pipelines, enabling the widespread theft of developer and cloud credentials. This group, also tracked by Trend Micro as SHADOW WATER, strategically injects malicious logic into commonly used CI/CD components, allowing their credential-stealing payloads to execute seamlessly as part of legitimate build and release processes.

Unlike traditional attacks that might target individual developer workstations, TeamPCP’s methodology focuses on siphoning critical secrets directly from the automated systems that power modern cloud infrastructure and software development workflows. According to a report by Trend Micro, this campaign has unfolded in at least seven distinct phases throughout March and April 2024.

Recent Supply Chain Compromises

In two notable incidents, TeamPCP successfully compromised Checkmarx KICS and the widely used Python package, elementary data. These breaches were part of a broader supply chain attack strategy where attackers poisoned official Docker images, code extensions, and GitHub Actions workflows. This allowed victim pipelines to unknowingly pull and execute the malicious payloads, treating them as standard, trusted components.

Trend Micro researchers highlighted that while the technical execution paths differed across incidents, the ultimate objective remained consistent: the large-scale exfiltration of developer and cloud credentials. The underlying principle exploited by TeamPCP is stark: once a single control point within a CI/CD pipeline is compromised, every subsequent trusted build step and release job can become a conduit for data exfiltration.

Checkmarx KICS and Bitwarden CLI Incidents

In the Checkmarx KICS compromise, the attackers engaged in multi-channel poisoning, distributing malicious images via the official KICS Docker Hub repository, alongside tainted VS Code and OpenVSX extensions, and modifying the project’s GitHub Actions workflow. These compromised artifacts delivered a JavaScript stealer module, designed to run on the Bun runtime during what appeared to be a routine KICS scan. The payload was engineered to harvest a broad array of sensitive data, including GitHub Personal Access Tokens (PATs), cloud credentials, SSH keys, configuration files, and shell history, which were then exfiltrated via HTTPS to attacker-controlled command and control (C2) infrastructure.

Within approximately 48 hours of the initial KICS exposure, the stolen tokens were leveraged by TeamPCP to publish a malicious release of the Bitwarden CLI. This expanded their reach to any developer or CI environment that installed the compromised Bitwarden client. The Bitwarden variant shared identical C2 domains, encryption methods, and even fallback recovery mechanisms via GitHub commit searches, reinforcing Trend Micro’s assessment of a unified campaign. Evidence of this coherence includes “Dune”-themed staging repositories and the recurring commit message “Long Live The Resistance Against Machines” across multiple attack waves.

Elementary Data Python Package Compromise

The elementary data incident showcased a simpler, yet equally alarming, attack vector. An attacker-controlled account submitted a specially crafted comment to a public pull request within the project’s GitHub repository. This comment was then directly interpolated into a shell command in a GitHub Actions workflow without proper sanitization. The injected script exploited the runner’s GitHub token to forge a tagged release commit, subsequently triggering the project’s legitimate signing pipeline. This resulted in the creation of a malicious Python wheel, which was then signed by the maintainers’ CI and uploaded to PyPI and GitHub Container Registry as if it were an authentic release.

Upon installation, the compromised elementary data package utilized a Python .pth file-based loader. This mechanism ensures the malicious code executes whenever the Python interpreter starts, even if the elementary data package itself is never explicitly imported. The stealer, written entirely in Python, was designed to evade detection by avoiding common malware patterns and leaving minimal artifacts on disk. It specifically targeted cloud and Kubernetes secrets, in addition to local keys and tokens. Data exfiltration occurred over HTTPS, featuring attacker-branded headers and a Cloudflare-fronted endpoint, followed by rapid rotation of the infrastructure post-operation.

The breadth of credentials targeted in both waves is extensive, encompassing GitHub PATs, various cloud keys (AWS, Azure, GCP), SSH material, Kubernetes secrets, database passwords, developer tooling tokens, and even cryptocurrency wallets. In AWS environments, the stealer went beyond local files, making live API calls to Secrets Manager and SSM Parameter Store to dump managed secrets that were never stored on disk. This combination of comprehensive credential coverage and supply chain infiltration poses a significant threat to organizations heavily relying on cloud-native CI/CD runners.

What You Should Do

• Implement Least Privilege: Enforce strict adherence to the principle of least privilege across all CI/CD workflows and artifacts. Each component should only have access to the secrets absolutely necessary for its function.
• Strengthen Network Egress Controls: Implement network egress filtering for CI/CD runners, restricting outbound HTTPS connections to an allowlist of known and essential endpoints and cloud services. This would prevent data exfiltration even if a component is compromised.
• Assume Compromise and Rotate Credentials: For organizations that pulled affected Checkmarx KICS Docker tags, installed the specific VS Code extensions, or compromised Bitwarden CLI versions, treat those environments as fully compromised. Immediately rotate all GitHub PATs, cloud IAM keys (AWS, Azure, GCP), Kubernetes service account tokens, SSH keys, database passwords, and any other secrets stored in environment variables or standard credential files (e.g., aws credentials, git credential stores).
• Upgrade and Verify Software: Upgrade to safe, verified versions of KICS images and extensions. Always verify Docker image digests instead of relying solely on mutable tags.
• Audit GitHub Actions Logs: Scrutinize GitHub Actions logs for suspicious “format check” jobs or any unexpected activity. Additionally, audit workflows for user-controlled expressions that are interpolated directly into shell commands without proper sanitization.
• Response for Elementary Data Compromise: Any host that installed the tainted elementary data PyPI package or container image should be considered compromised. Prioritize rotation of cloud access keys, service account keys, Azure credentials, Kubernetes tokens, GitHub tokens, Vault tokens, npm and PyPI credentials, and any cryptocurrency wallets on disk.
• Forensic Investigation: Incident responders should search for persistence marker files in the system’s temporary directory, unusually large elementary data .pth files in Python site packages, and outbound connections to documented C2 and staging domains.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.