[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZG-GcRcIoNopsqznWdO40VZq_NFujl8zb7pLnxEONc4":3,"$fkReezB-VelUKj49xBtbbZAn-wMTqQ66ZIT2PhRCIJC0":37},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":34,"created_at":35,"updated_at":36,"published_at":25},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories","The group injected trojanized code into 236 branches across Azure, Azure-Samples, and Microsoft orgs via a compromised GitHub account.","TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.",[10,11,12,13,14],"TeamPCP","supply-chain","GitHub","Microsoft","Azure","# TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories\n\n*The group injected trojanized code into 236 branches across Azure, Azure-Samples, and Microsoft orgs via a compromised GitHub account.*\n\n**Tags:** `TeamPCP` `supply-chain` `GitHub` `Microsoft` `Azure`\n\n> TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.\n\n---\n\n## TeamPCP hits Microsoft's GitHub orgs with new malware\n\nTeamPCP compromised a GitHub account to inject malicious code into at least 42 repositories and 236 branches across the Azure, Azure-Samples and Microsoft GitHub organizations. The trojanized packages were published between 02:36 and 02:41 UTC on June 5, 2026.\n\nWIZ Cloud Threat Landscape identifies the operation as a supply-chain attack with initial access via the GitHub vector.\n\n## The new malware: what it does and where it lands\n\nThe payload is a new variant in TeamPCP’s toolkit, delivered through trojanized GitHub packages. It targets developer environments, where it harvests credentials and tokens that grant downstream access to connected services and repositories.\n\nTeamPCP published the malware source code to GitHub, a move that has already triggered copycat adoption. Independent actors have begun modifying the code and expanding its reach, with the first copycat deployment observed in four malicious npm packages uploaded via typosquatting.\n\n## Part of a broader TeamPCP campaign wave\n\nThis is the latest in a sustained TeamPCP campaign wave. The group, also tracked as UNC6780, is a cybercrime actor that has made supply-chain compromise its primary initial access vector, trojanizing trusted packages to deploy credential stealers and infostealers into developer environments.\n\nThe Microsoft GitHub orgs hit here follow TeamPCP’s Mini Shai-Hulud worm, which compromised over 160 npm and PyPI packages in May 2026. That campaign abused GitHub Actions cache poisoning and stolen OIDC tokens to publish malicious updates, impacting ecosystems tied to TanStack, Mistral AI, UiPath, and OpenSearch.\n\nThe same actor also claimed responsibility in late March 2026 for supply-chain compromises of the Trivy vulnerability scanner, Checkmarx, LiteLLM, and BerriAI GitHub repositories. Mandiant responded to a wave of incident response engagements tied to that activity, underscing the breadth of TeamPCP’s GitHub-based operations.\n\n## Key points\n\n- TeamPCP compromised a GitHub account to inject malicious code into 42+ repositories and 236 branches across Azure, Azure-Samples, and Microsoft orgs.\n- The attack publishes trojanized packages directly to the GitHub orgs, giving developers a supply-chain initial access vector.\n- This is the latest in TeamPCP's 2026 campaign that has also hit Trivy, Checkmarx, LiteLLM, BerriAI, and 160+ npm\u002FPyPI packages via the Mini Shai-Hulud worm.\n- The group is tracked as UNC6780 and has been active since late March 2026, with the FBI confirming its role in large-scale software supply chain compromises.\n\n## Further reading & sources\n\n- [TeamPCP adds Malware to Multiple Microsoft-Linked GitHub Projects](https:\u002F\u002Fthreats.wiz.io\u002Fall-incidents\u002Fteampcp-adds-malware-to-multiple-microsoft-linked-github-projects) — WIZ Cloud Threat Landscape\n- [CERT-EU - Cyber Brief 26-06 - May 2026](https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fthreat-intelligence\u002Fcb26-06)\n- [Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fai-vulnerability-exploitation-initial-access)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-06-jul-2026-b094bb1c520c)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163",{"malware":18,"targets":21,"industries":26,"technologies":30},[19],{"name":20},"Malware",[22],{"name":13,"sector":23,"status":24,"geography":25},"Technology","confirmed",null,[27],{"url":28,"name":23,"slug":29},"\u002Findustries\u002Ftechnology","technology",[31,33],{"vendor":13,"product":32},"Exchange",{"vendor":12,"product":12},"threat_actor_activity","2026-08-26T17:02:14.429711+00:00","2026-10-16T12:29:19.41534+00:00",{"articles":38},[39,51,67,79],{"slug":40,"title":41,"summary":42,"tags":43,"hero_image_url":49,"story_type":34,"created_at":50},"palo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign","Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign","Palo Alto Networks Unit 42 published a threat brief on August 18, 2026, detailing TheHatman's large-scale credential attack campaign that ran from August 1–17, 2026, where the actor exfiltrated ~3.6M employee records from Microsoft Entra tenants and sold them across multiple forums.",[44,45,46,47,48,14],"TheHatman","Palo Alto Unit 42","Microsoft Entra","password spraying","MFA fatigue","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign.png?v=a517fffda4","2026-09-17T17:06:03.041262+00:00",{"slug":52,"title":53,"summary":54,"tags":55,"hero_image_url":65,"story_type":34,"created_at":66},"fortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir","FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign","FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.",[56,57,58,59,13,60,61,62,63,64],"Handala","FortiGuard","Iran","Outbreak Alert","Oracle","Apache","Hikvision","Atlassian","Ivanti","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir.png?v=6da17f1ec2","2026-08-31T12:10:30.775227+00:00",{"slug":68,"title":69,"summary":70,"tags":71,"hero_image_url":76,"story_type":77,"created_at":78},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages","Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.",[72,73,11,74,75],"ChainDrop","npm","Shai-Hulud","Ethereum C2","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8","supply_chain","2026-09-26T12:08:48.531258+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":88,"story_type":89,"created_at":90},"zdi-july-2026-88-cves-in-adobe-coldfusion-commerce-and-microsoft","ZDI July 2026: 88+ CVEs in Adobe ColdFusion, Commerce, and Microsoft","ZDI's July 2026 Security Update Review covers 88+ unique CVEs across Adobe ColdFusion, Adobe Commerce, and Microsoft, with 63 rated Critical and two under active exploitation.",[84,85,86,13,87],"ZDI","Adobe ColdFusion","Adobe Commerce","CVE-2022-20701","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fzdi-july-2026-88-cves-in-adobe-coldfusion-commerce-and-microsoft.png?v=6b09bbbf4c","vulnerability_disclosure","2026-09-09T07:08:04.01292+00:00"]