MalwarePublished 8 May 2026

‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials

Source SecurityWeek

Description

The malware framework targets web applications and cloud environments, including AWS, Docker, Kubernetes, and more. The post ‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials appeared first on SecurityWeek .

Impact

PCPJack compromises infected systems by removing competing malware (TeamPCP), stealing sensitive credentials and tokens for cloud services and web applications, and enabling lateral movement within cloud and container environments. The stolen credentials can be used for spam campaigns, financial fraud, and extortion attacks. The malware's exploitation of multiple known vulnerabilities in popular web applications increases the risk of widespread infection and persistence. The use of encrypted Telegram channels for command-and-control complicates detection and response. There is no indication of direct data destruction or ransomware deployment, but the theft and misuse of credentials pose significant operational and financial risks.

Defensive guidance

Mitigation should focus on applying security patches for the known exploited vulnerabilities in web applications targeted by PCPJack (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703). Organizations should also audit and rotate credentials, SSH keys, and tokens used in cloud and container environments. Monitoring for unusual lateral movement and unauthorized access to cloud services is recommended. Since PCPJack removes TeamPCP infections, detection of one may indicate the presence or prior presence of the other. Incident response should include credential revocation and forensic analysis. The vendor SentinelOne provides detailed threat intelligence and detection capabilities for PCPJack. Patch status is not applicable to the malware framework itself; check vendor advisories for updates on related vulnerabilities.

References

securityweek.com/pcpjack-worm-removes-teampcp-infections-steals-credentials/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 08:36 UTC

References

Community reviews

Related threats