# PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)

> PCPJack is a Linux-targeting cloud worm publicly disclosed by SentinelLabs on 2026-05-07 that exploits five CVEs to gain initial access against exposed Docker, Kubernetes, Redis, MongoDB, RayML, and SSH services, harvests credentials at scale across 25+ cloud, developer, financial, and messaging providers, and uniquely evicts artifacts of the rival TeamPCP cryptojacking actor before establishing Sliver C2 beacons. Exfiltration occurs over Telegram channels protected by ChaCha20-Poly1305 with X25519 ECDH key exchange. The framework operates as a self-propagating Python toolkit dropped under /var/lib/.spm/ and persisted via the spm-worker.service systemd unit.

- **Published:** 2026-05-07T12:00:00Z
- **Last reviewed:** 2026-05-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0478
- **ID:** TL-2026-0478
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** PCPJack operators
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703

## Description

OVERVIEW

PCPJack is a self-propagating, Linux-focused credential-theft framework first publicly attributed by SentinelLabs (Alex Delamotte) on May 7, 2026. The toolkit is implemented primarily in Python, dropped to /var/lib/.spm/ on compromised hosts, and persisted through a systemd service named spm-worker.service. PCPJack chains five publicly disclosed CVEs against widely-deployed application stacks and complements that exploitation with mass scanning of exposed cloud infrastructure (Docker daemon ports 2375/2376, Kubernetes API, Redis, MongoDB, and RayML on port 8265). Once a host is compromised, the worm enumerates and exfiltrates secrets from more than two dozen cloud, developer, payment, and cryptocurrency services, and deploys an architecture-specific Sliver C2 beacon for hands-on operator control.

INITIAL ACCESS

PCPJack's exploitation library targets five disclosed vulnerabilities:

- CVE-2025-29927 — Next.js middleware authorization bypass via the x-middleware-subrequest header, allowing route-level access controls to be skipped.
- CVE-2025-55182 — React/Next.js related vulnerability used to gain code execution on misconfigured server-side render targets.
- CVE-2026-1357 — WPVivid Backup WordPress plugin authenticated arbitrary file upload leading to PHP code execution (disclosed February 2026).
- CVE-2025-9501 — W3 Total Cache WordPress plugin remote code execution flaw enabling unauthenticated command execution under web-server context.
- CVE-2025-48703 — CentOS Web Panel (CWP) command injection in the file management API, abused for unauthenticated RCE on Linux servers.

In parallel, the worm scans the public internet for exposed Docker REST APIs (2375/2376), unauthenticated Kubernetes APIs, AUTH-disabled Redis, accessible MongoDB instances, and Ray AI cluster dashboards (RayML, 8265). Infrastructure hosting the scanning fleet has been observed in 38.242.0.0/16, 161.97.0.0/16, 193.187.129.0/24, and 213.136.80.0/24 ranges (largely European bulletproof / VPS providers).

EXECUTION AND PERSISTENCE

On successful exploitation, a bootstrap.sh stager pulls the main Python toolkit (worm.py, monitor.py, utils.py, lateral.py, crypto_util.py, cloud_ranges.py, cloud_scan.py, extractor.py) into /var/lib/.spm/ along with helper binaries (update.bin, update-386.bin, update-arm.bin) for the architecture-specific Sliver beacon. A systemd unit at /etc/systemd/system/spm-worker.service is registered to maintain persistence; the file /tmp/.origin records the entry vector for telemetry and rival-tracking.

CREDENTIAL ACCESS

PCPJack's extractor.py harvests credentials from a wide and growing set of sources: AWS IMDS (both v1 and v2), Kubernetes service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token), Docker secrets and ~/.docker/config.json, SSH private keys and known_hosts, Slack/Discord/GitHub tokens, HashiCorp Vault tokens, 1Password configs, OpenAI and Anthropic API keys, DigitalOcean PATs, Stripe and Twilio API keys, SendGrid/Mailchimp credentials, Gmail OAuth tokens, browser cookie stores, WordPress wp-config.php files, and crypto-wallet artifacts (Binance, Coinbase, Kraken, Gemini API keys; Solana keypairs; Bitcoin wallet.dat; Ethereum keystore JSON). Recovered credentials are immediately validated and packaged for exfiltration.

LATERAL MOVEMENT

lateral.py uses recovered SSH keys, kubeconfig files, AWS keys, and cloud metadata tokens to pivot. From AWS-attached identities the operators enumerate IAM, S3, EC2 metadata, Lambda functions, and Secrets Manager. From Kubernetes service accounts they enumerate pods, secrets, and config maps and attempt to schedule worker pods. The framework specifically uses recovered credentials to seed cloud_ranges.json (cached at /var/lib/.spm/_cr/ranges.json), which expands the next scanning round.

DEFENSE EVASION AND TEAMPCP EVICTION

A distinguishing behavior is the active eviction of the rival TeamPCP cryptojacking actor: PCPJack searches for and removes TeamPCP processes, scheduled jobs, containers, dropped binaries, and persistence units, and reports a 'PCP replaced' telemetry metric back to operator infrastructure. SentinelLabs assesses with moderate confidence this overlaps tradecraft with — but is operated separately from — the previously-tracked TeamPCP cluster.

COMMAND AND CONTROL / EXFILTRATION

PCPJack uses Telegram bot channels as its primary exfiltration transport. Stolen secrets and host telemetry are encrypted with ChaCha20-Poly1305 using a per-message symmetric key derived via X25519 ECDH against the operator public key 6d4imqQ/s/GfQCVcybdcjfTe/PMYHtZN8ZGHnEXSbRo=. Payloads are split into 2800-byte chunks before transmission. A secondary Sliver implant provides interactive C2 over HTTPS. Reported staging domains include cdn.cloudfront-js.com, spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws.com, and lastpass-login-help.com.

IMPACT

Direct impact includes mass credential theft enabling downstream financial fraud (cryptocurrency wallet draining), follow-on cloud-resource hijacking, and supply-chain footholds via stolen developer tokens. Compromise of CI/CD secrets (GitHub PATs, Vault tokens) materially increases the blast radius beyond the initially compromised host.

DEFENDER PRIORITIES

(1) Patch the five referenced CVEs immediately and audit Next.js, WordPress, and CWP fleets. (2) Restrict Docker, Kubernetes, Redis, MongoDB, and RayML management endpoints with network ACLs and authentication; do not expose 2375/2376/8265 to the internet. (3) Rotate AWS, Kubernetes, GitHub, Slack, Vault, OpenAI, Anthropic, and crypto-exchange credentials on any host that may have been exposed. (4) Hunt for /var/lib/.spm/, /tmp/.origin, and spm-worker.service. (5) Block listed Telegram and S3 staging URLs at egress and alert on outbound chunked Telegram bot API traffic from server workloads.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1610 Deploy Container
- T1543.002 Create or Modify System Process: Systemd Service
- T1053.003 Scheduled Task/Job: Cron
- T1068 Exploitation for Privilege Escalation
- T1070.004 Indicator Removal: File Deletion
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1685 Disable or Modify Tools
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.007 Unsecured Credentials: Container API
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1046 Network Service Discovery
- T1526 Cloud Service Discovery
- T1613 Container and Resource Discovery
- T1021.004 Remote Services: SSH
- T1210 Exploitation of Remote Services
- T1119 Automated Collection
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1030 Data Transfer Size Limits
- T1496 Resource Hijacking
- T1489 Service Stop

## Sources

- [PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale](https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/)
- [New PCPJack worm steals credentials, cleans TeamPCP infections](https://www.bleepingcomputer.com/news/security/new-pcpjack-worm-steals-credentials-cleans-teampcp-infections/)
- [PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems](https://thehackernews.com/2026/05/pcpjack-credential-stealer-exploits-5.html)
- [Hackers hack victims hacked by other hackers](https://techcrunch.com/2026/05/07/hackers-hack-victims-hacked-by-other-hackers/)
- [NVD — CVE-2025-29927 (Next.js middleware authorization bypass)](https://nvd.nist.gov/vuln/detail/CVE-2025-29927)
- [NVD — CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [NVD — CVE-2026-1357 (WPVivid Backup)](https://nvd.nist.gov/vuln/detail/CVE-2026-1357)
- [NVD — CVE-2025-9501 (W3 Total Cache RCE)](https://nvd.nist.gov/vuln/detail/CVE-2025-9501)
- [NVD — CVE-2025-48703 (CentOS Web Panel RCE)](https://nvd.nist.gov/vuln/detail/CVE-2025-48703)
- [Next.js Security Advisory — Authorization Bypass in Middleware](https://nextjs.org/blog/cve-2025-29927)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0478