PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)
PCPJack Worm (TL-2026-0478), also tracked as PCPJack, is a critical-severity malware campaign scored CVSS 9.8, first published 2026-05-07. It is attributed to PCPJack operators with medium confidence, affects Vercel Next.js, references 5 CVEs (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357), maps to 38 MITRE ATT&CK techniques (T1005, T1021.004, T1030), and is covered by 9 detection rules and 47 indicators of compromise.
Key facts for TL-2026-0478
- Threat ID
- TL-2026-0478
- Also known as
- PCPJack, SPM worker, spm-worker
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-07
- Last reviewed
- 2026-05-07
- Attribution
- PCPJack operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, cryptocurrency, saas, web-hosting, ai-ml, developer-tools, media
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 47
Malware and tooling in PCPJack Worm
Malware and tooling: PCPJack, spm-worker, Sliver - S0633
PCPJack is a Linux-targeting cloud worm publicly disclosed by SentinelLabs on 2026-05-07 that exploits five CVEs to gain initial access against exposed Docker, Kubernetes, Redis, MongoDB, RayML, and SSH services, harvests credentials at scale across 25+ cloud, developer, financial, and messaging providers, and uniquely evicts artifacts of the rival TeamPCP cryptojacking actor before establishing Sliver C2 beacons. Exfiltration occurs over Telegram channels protected by ChaCha20-Poly1305 with X25519 ECDH key exchange. The framework operates as a self-propagating Python toolkit dropped under /var/lib/.spm/ and persisted via the spm-worker.service systemd unit.
How PCPJack Worm works
OVERVIEW
PCPJack is a self-propagating, Linux-focused credential-theft framework first publicly attributed by SentinelLabs (Alex Delamotte) on May 7, 2026. The toolkit is implemented primarily in Python, dropped to /var/lib/.spm/ on compromised hosts, and persisted through a systemd service named spm-worker.service. PCPJack chains five publicly disclosed CVEs against widely-deployed application stacks and complements that exploitation with mass scanning of exposed cloud infrastructure (Docker daemon ports 2375/2376, Kubernetes API, Redis, MongoDB, and RayML on port 8265). Once a host is compromised, the worm enumerates and exfiltrates secrets from more than two dozen cloud, developer, payment, and cryptocurrency services, and deploys an architecture-specific Sliver C2 beacon for hands-on operator control.
INITIAL ACCESS
PCPJack's exploitation library targets five disclosed vulnerabilities:
- CVE-2025-29927 — Next.js middleware authorization bypass via the x-middleware-subrequest header, allowing route-level access controls to be skipped. - CVE-2025-55182 — React/Next.js related vulnerability used to gain code execution on misconfigured server-side render targets. - CVE-2026-1357 — WPVivid Backup WordPress plugin authenticated arbitrary file upload leading to PHP code execution (disclosed February 2026). - CVE-2025-9501 — W3 Total Cache WordPress plugin remote code execution flaw enabling unauthenticated command execution under web-server context. - CVE-2025-48703 — CentOS Web Panel (CWP) command injection in the file management API, abused for unauthenticated RCE on Linux servers.
In parallel, the worm scans the public internet for exposed Docker REST APIs (2375/2376), unauthenticated Kubernetes APIs, AUTH-disabled Redis, accessible MongoDB instances, and Ray AI cluster dashboards (RayML, 8265). Infrastructure hosting the scanning fleet has been observed in 38.242.0.0/16, 161.97.0.0/16, 193.187.129.0/24, and 213.136.80.0/24 ranges (largely European bulletproof / VPS providers).
EXECUTION AND PERSISTENCE
On successful exploitation, a bootstrap.sh stager pulls the main Python toolkit (worm.py, monitor.py, utils.py, lateral.py, crypto_util.py, cloud_ranges.py, cloud_scan.py, extractor.py) into /var/lib/.spm/ along with helper binaries (update.bin, update-386.bin, update-arm.bin) for the architecture-specific Sliver beacon. A systemd unit at /etc/systemd/system/spm-worker.service is registered to maintain persistence; the file /tmp/.origin records the entry vector for telemetry and rival-tracking.
CREDENTIAL ACCESS
PCPJack's extractor.py harvests credentials from a wide and growing set of sources: AWS IMDS (both v1 and v2), Kubernetes service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token), Docker secrets and ~/.docker/config.json, SSH private keys and known_hosts, Slack/Discord/GitHub tokens, HashiCorp Vault tokens, 1Password configs, OpenAI and Anthropic API keys, DigitalOcean PATs, Stripe and Twilio API keys, SendGrid/Mailchimp credentials, Gmail OAuth tokens, browser cookie stores, WordPress wp-config.php files, and crypto-wallet artifacts (Binance, Coinbase, Kraken, Gemini API keys; Solana keypairs; Bitcoin wallet.dat; Ethereum keystore JSON). Recovered credentials are immediately validated and packaged for exfiltration.
LATERAL MOVEMENT
lateral.py uses recovered SSH keys, kubeconfig files, AWS keys, and cloud metadata tokens to pivot. From AWS-attached identities the operators enumerate IAM, S3, EC2 metadata, Lambda functions, and Secrets Manager. From Kubernetes service accounts they enumerate pods, secrets, and config maps and attempt to schedule worker pods. The framework specifically uses recovered credentials to seed cloud_ranges.json (cached at /var/lib/.spm/_cr/ranges.json), which expands the next scanning round.
DEFENSE EVASION AND TEAMPCP EVICTION
A distinguishing behavior is the active eviction of the rival TeamPCP cryptojacking actor: PCPJack searches for and removes TeamPCP processes, scheduled jobs, containers, dropped binaries, and persistence units, and reports a 'PCP replaced' telemetry metric back to operator infrastructure. SentinelLabs assesses with moderate confidence this overlaps tradecraft with — but is operated separately from — the previously-tracked TeamPCP cluster.
COMMAND AND CONTROL / EXFILTRATION
PCPJack uses Telegram bot channels as its primary exfiltration transport. Stolen secrets and host telemetry are encrypted with ChaCha20-Poly1305 using a per-message symmetric key derived via X25519 ECDH against the operator public key 6d4imqQ/s/GfQCVcybdcjfTe/PMYHtZN8ZGHnEXSbRo=. Payloads are split into 2800-byte chunks before transmission. A secondary Sliver implant provides interactive C2 over HTTPS. Reported staging domains include cdn.cloudfront-js.com, spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws.com, and lastpass-login-help.com.
IMPACT
Direct impact includes mass credential theft enabling downstream financial fraud (cryptocurrency wallet draining), follow-on cloud-resource hijacking, and supply-chain footholds via stolen developer tokens. Compromise of CI/CD secrets (GitHub PATs, Vault tokens) materially increases the blast radius beyond the initially compromised host.
DEFENDER PRIORITIES
(1) Patch the five referenced CVEs immediately and audit Next.js, WordPress, and CWP fleets. (2) Restrict Docker, Kubernetes, Redis, MongoDB, and RayML management endpoints with network ACLs and authentication; do not expose 2375/2376/8265 to the internet. (3) Rotate AWS, Kubernetes, GitHub, Slack, Vault, OpenAI, Anthropic, and crypto-exchange credentials on any host that may have been exposed. (4) Hunt for /var/lib/.spm/, /tmp/.origin, and spm-worker.service. (5) Block listed Telegram and S3 staging URLs at egress and alert on outbound chunked Telegram bot API traffic from server workloads.
MITRE ATT&CK techniques used in TL-2026-0478
Collection
T1005 Data from Local System; T1119 Automated Collection
Lateral Movement
T1021.004 Remote Services: SSH; T1210 Exploitation of Remote Services
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Discovery
T1046 Network Service Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery
Persistence
T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1610 Deploy Container
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070.004 Indicator Removal: File Deletion; T1564.001 Hide Artifacts: Hidden Files and Directories
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1489 Service Stop; T1496 Resource Hijacking
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API; T1555 Credentials from Password Stores
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning
defense-impairment
Affected products and versions in PCPJack Worm
- Vercel — Next.js
Vulnerable versions: <12.3.5; 13.0.0-13.5.8; 14.0.0-14.2.24; 15.0.0-15.2.2
Fixed in: 12.3.5; 13.5.9; 14.2.25; 15.2.3 - Meta / Vercel — React / Next.js
Vulnerable versions: affected per CVE-2025-55182 advisory
Fixed in: per vendor advisory - WPVivid — WPVivid Backup for WordPress
Vulnerable versions: per CVE-2026-1357 advisory
Fixed in: per vendor advisory - BoldGrid — W3 Total Cache for WordPress
Vulnerable versions: per CVE-2025-9501 advisory
Fixed in: per vendor advisory - CentOS Web Panel — CentOS Web Panel (CWP)
Vulnerable versions: per CVE-2025-48703 advisory
Fixed in: per vendor advisory - Docker — Docker Engine REST API
Vulnerable versions: any version exposing 2375/2376 without TLS+auth
Fixed in: network-isolated configurations - Cloud Native Computing Foundation — Kubernetes API server
Vulnerable versions: any version with anonymous-auth or exposed kubelet
Fixed in: RBAC + private endpoints - Redis Ltd. — Redis
Vulnerable versions: any internet-exposed instance without AUTH
Fixed in: AUTH + ACL + network isolation - MongoDB Inc. — MongoDB
Vulnerable versions: any internet-exposed instance without authentication
Fixed in: SCRAM auth + bind-IP restrictions - Anyscale — Ray (RayML)
Vulnerable versions: any cluster exposing dashboard 8265 to public internet
Fixed in: network isolation + auth proxy
Remediation for PCPJack Worm
Patches
- Next.js 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3 (CVE-2025-29927)
- React/Next.js patched releases for CVE-2025-55182
- WPVivid Backup updated release for CVE-2026-1357
- W3 Total Cache updated release for CVE-2025-9501
- CentOS Web Panel updated release for CVE-2025-48703
Immediate actions
- Patch CVE-2025-29927 (Next.js) — upgrade to 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3 or later and verify x-middleware-subrequest header is rejected at the edge.
- Patch CVE-2025-55182 by upgrading affected React/Next.js versions per vendor advisory.
- Update WPVivid Backup (CVE-2026-1357) to the latest release; review WordPress upload directories for PHP files.
- Update W3 Total Cache (CVE-2025-9501) to the patched version; audit wp-content/plugins/w3-total-cache for tampering.
- Patch CentOS Web Panel (CVE-2025-48703) and audit /usr/local/cwpsrv access logs for command-injection payloads.
- Block the listed PCPJack C2 / staging IPs and domains at perimeter and DNS layers.
- Rotate all secrets recoverable from compromised hosts: AWS keys/IMDS-derived tokens, Kubernetes SA tokens, GitHub PATs, Slack tokens, Vault tokens, OpenAI / Anthropic keys, exchange API keys, Stripe / Twilio / SendGrid keys.
- Search for /var/lib/.spm/, /tmp/.origin, and spm-worker.service across the Linux fleet.
Workarounds
- Strip the x-middleware-subrequest header at edge / reverse proxy until Next.js can be upgraded.
- Disable WPVivid Backup and W3 Total Cache plugins on WordPress installations that cannot be patched immediately.
- Restrict CentOS Web Panel admin endpoints to allow-listed management IPs.
- Apply firewall rules dropping inbound traffic to 2375/2376/8265 from the public internet.
Longer-term hardening
- Remove direct internet exposure from Docker (2375/2376), Kubernetes API, Redis, MongoDB, and RayML (8265). Place behind VPN or zero-trust gateway.
- Enforce IMDSv2 with hop limit 1 on all EC2 instances to defeat IMDS theft via SSRF and container escape.
- Bind least-privilege IAM roles to compute; deny IMDS access from container workloads that don't need it.
- Deploy Linux EDR with eBPF/auditd visibility for systemd unit creation, /var/lib/.spm/* writes, and outbound Telegram bot API traffic from server workloads.
- Mandate short-lived Kubernetes service account tokens (BoundServiceAccountTokenVolume) and projected token audiences.
- Apply network-egress allow-listing for production server workloads; block api.telegram.org from non-approved tenants.
- Continuous secret-scanning across CI/CD, source repos, and runtime filesystems.
CVEs associated with PCPJack Worm
CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703
Weaknesses (CWE) in PCPJack Worm
CWE-285, CWE-77, CWE-78, CWE-434, CWE-94, CWE-306, CWE-522, CWE-552
Timeline of PCPJack Worm
- CVE-2025-29927 (Next.js middleware authorization bypass via x-middleware-subrequest) publicly disclosed and patched.
- CVE-2025-48703 (CentOS Web Panel command injection) publicly disclosed.
- CVE-2025-55182 (React/Next.js related vulnerability) publicly disclosed.
- CVE-2025-9501 (W3 Total Cache RCE) publicly disclosed.
- CVE-2026-1357 (WPVivid Backup arbitrary file upload) publicly disclosed.
- Earliest PCPJack samples and /var/lib/.spm/ artifacts referenced in SentinelLabs telemetry.
- Threadlinqs Intelligence indexed the campaign as TL-2026-0478 and linked rivalry to TeamPCP cluster (TL-2026-0290/0298/0299/0304/0361).
- SentinelLabs publishes attribution and IOC set for PCPJack worm; coverage from BleepingComputer, The Hacker News, and TechCrunch on the same day.
- As of 2026-05-29, PCPJack remains an active, undisrupted Linux cloud worm: SentinelLabs (disclosed ~May 7, with the script first seen Apr 28) reports it self-propagating via 5 CVEs — several actively exploited (CVE-2025-29927 Next.js, CVE-2025-55182 React2Shell) — and no takedown, sinkhole, or arrest has been reported. It harvests credentials across 25+ cloud/dev/financial providers and beacons over Sliver, so exposed Docker/K8s/Redis/SSH hosts stay at live risk.
Sources cited for PCPJack Worm
- PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
- New PCPJack worm steals credentials, cleans TeamPCP infections
- PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
- Hackers hack victims hacked by other hackers
- NVD — CVE-2025-29927 (Next.js middleware authorization bypass)
- NVD — CVE-2025-55182
- NVD — CVE-2026-1357 (WPVivid Backup)
- NVD — CVE-2025-9501 (W3 Total Cache RCE)
- NVD — CVE-2025-48703 (CentOS Web Panel RCE)
- Next.js Security Advisory — Authorization Bypass in Middleware
Threats related to PCPJack Worm
- Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)
- NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access
- PCPJack Covert SMTP Relay Network — 230 Hijacked AWS/Google Cloud/Azure Servers via Sliver C2 + Chisel SOCKS Tunneling
- Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)
- Agentic Threat Actor Container Escape — AI Agent-Driven marimo CVE-2026-39987 RCE → Docker Socket → Host Breakout (nsenter) → Kubernetes Secret Store Dump (Sysdig TRT)
- Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential Harvesting (Backdoor.Linux.QLNX.A)
Detection coverage for TL-2026-0478
As of 2026-05-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0478 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.