TeamPCP Cloud StealerMalware
- SANDCLOCK
The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.From MITRE ATT&CK
Last reported 2 months ago, by Google Threat Intelligence1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1176.002IDE Extensions
“Developer Workstation & IDE Compromise: Targeted social engineering, malicious IDE extensions, or typosquatted local dependencies designed to exfiltrate private cryptographic keys, API tokens, and local session credentials.”
- T1195Supply Chain Compromise
“Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise”
- T1195.001Compromise Software Dependencies and Development Tools
“…ents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001).”
- T1195.002Compromise Software Supply Chain
“… high confidence that traditional software supply chain compromise, the manipulation of source code or update/distribution mechanisms (T1195.002), remains rare.”
- T1213.003Code Repositories
“…t impactful and far-reaching supply chain compromise incidents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001).”
- T1553.002Code Signing
“Hardware-Backed Key Protection: Secure code-signing certificates using Hardware Security Modules (HSMs) or vaulting solutions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“The threat actor typically used compromised packages to deploy credential stealers, including SANDCLOCK, to obtain high value secrets.”
Indicators in its reports
named in the reports above- osv[.]devin 1 report
Copy this indicator · defanged
Thanks — we review every report.