[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZG-GcRcIoNopsqznWdO40VZq_NFujl8zb7pLnxEONc4":3,"$fkReezB-VelUKj49xBtbbZAn-wMTqQ66ZIT2PhRCIJC0":37},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":34,"created_at":35,"updated_at":36,"published_at":25},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Added Malware to 42 Microsoft-Linked GitHub Repositories in June","On 5 June 2026 the group used a compromised GitHub account to push malicious code to 236 branches across the Azure, Azure-Samples and Microsoft organisations.","On 5 June 2026 TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches in the Azure, Azure-Samples and Microsoft GitHub organisations, according to Wiz. The incident followed the group's earlier supply-chain compromises of Trivy, Checkmarx, LiteLLM and BerriAI and its Mini Shai-Hulud npm and PyPI campaign.",[10,11,12,13,14],"TeamPCP","supply-chain","GitHub","Microsoft","Azure","# TeamPCP Added Malware to 42 Microsoft-Linked GitHub Repositories in June\n\n*On 5 June 2026 the group used a compromised GitHub account to push malicious code to 236 branches across the Azure, Azure-Samples and Microsoft organisations.*\n\n**Tags:** `TeamPCP` `supply-chain` `GitHub` `Microsoft` `Azure`\n\n> On 5 June 2026 TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches in the Azure, Azure-Samples and Microsoft GitHub organisations, according to Wiz. The incident followed the group's earlier supply-chain compromises of Trivy, Checkmarx, LiteLLM and BerriAI and its Mini Shai-Hulud npm and PyPI campaign.\n\n---\n\n## TeamPCP hits Microsoft-linked GitHub organisations\n\nAccording to Wiz's Cloud Threat Landscape, TeamPCP leveraged a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches across the Azure, Azure-Samples and Microsoft GitHub organisations. The malicious commits were made between 02:36 and 03:22 UTC on 5 June 2026.\n\nWiz classifies the activity as a supply-chain attack. As of 14:00 UTC on 5 June, Wiz reported that the malicious code was present only in the GitHub repositories and had not been pushed to other distribution channels. Wiz has not published details of the malware's functionality.\n\n## Part of a broader TeamPCP campaign\n\nTeamPCP, also tracked by Google as UNC6780, is a cybercrime actor that uses supply-chain compromise as a primary initial access vector. Google's Threat Intelligence Group reports that in late March 2026 TeamPCP claimed responsibility for compromising GitHub repositories and GitHub Actions linked to the Trivy vulnerability scanner, Checkmarx, LiteLLM and BerriAI, using them to deploy the SANDCLOCK credential stealer, and that Mandiant responded to numerous incident response engagements tied to that activity.\n\nIn May 2026, according to CERT-EU, TeamPCP's Mini Shai-Hulud campaign compromised over 160 npm and PyPI packages by abusing GitHub Actions cache poisoning and stolen OIDC tokens, affecting ecosystems including TanStack, Mistral AI, UiPath and OpenSearch. CERT-EU also reports that TeamPCP later published the Mini Shai-Hulud malware source code and that copycat actors adopted it, with four malicious npm packages using a clone of the leaked code reported on 17 May.\n\n## Key points\n\n- On 5 June 2026, between 02:36 and 03:22 UTC, TeamPCP pushed malicious code to at least 42 repositories and 236 branches in the Azure, Azure-Samples and Microsoft GitHub organisations via a compromised account.\n- Wiz reported that the code had not spread beyond GitHub as of 14:00 UTC that day and has not described the payload.\n- Google tracks TeamPCP as UNC6780; the group claimed the Trivy, Checkmarx, LiteLLM and BerriAI compromises in late March 2026.\n- CERT-EU attributes the May 2026 Mini Shai-Hulud campaign, which hit over 160 npm and PyPI packages, to TeamPCP.\n\n## Further reading & sources\n\n- [TeamPCP adds Malware to Multiple Microsoft-Linked GitHub Projects](https:\u002F\u002Fthreats.wiz.io\u002Fall-incidents\u002Fteampcp-adds-malware-to-multiple-microsoft-linked-github-projects) — Wiz Cloud Threat Landscape\n- [CERT-EU - Cyber Brief 26-06 - May 2026](https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fthreat-intelligence\u002Fcb26-06) — CERT-EU\n- [Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fai-vulnerability-exploitation-initial-access) — Google Cloud Blog","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163",{"malware":18,"targets":21,"industries":26,"technologies":30},[19],{"name":20},"Malware",[22],{"name":13,"sector":23,"status":24,"geography":25},"Technology","confirmed",null,[27],{"url":28,"name":23,"slug":29},"\u002Findustries\u002Ftechnology","technology",[31,33],{"vendor":13,"product":32},"Exchange",{"vendor":12,"product":12},"threat_actor_activity","2026-08-26T17:02:14.429711+00:00","2026-10-16T12:29:19.41534+00:00",{"articles":38},[39,51,64,77],{"slug":40,"title":41,"summary":42,"tags":43,"hero_image_url":48,"story_type":49,"created_at":50},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","ChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv","Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.",[44,45,11,46,47],"ChainDrop","npm","Shai-Hulud","Ethereum C2","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8","supply_chain","2026-09-26T12:08:48.531258+00:00",{"slug":52,"title":53,"summary":54,"tags":55,"hero_image_url":62,"story_type":34,"created_at":63},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[56,57,58,59,60,61],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":75,"story_type":34,"created_at":76},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[69,70,71,72,73,74],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":88,"story_type":34,"created_at":89},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[82,83,84,85,86,87],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00"]