PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems

PCPJack is a new credential theft framework that exploits cloud infrastructure and spreads worm-like across cloud systems.

• •Targets cloud services including Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications
• •Exploits 5 known CVEs (CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703) for lateral movement and propagation
• •Deploys six Python modules (orchestrator, credential parser, lateral movement tool, encryption utility, cloud IP range collector, and cloud port scanner)
• •Uses Telegram for command-and-control (C2) communication and exfiltrates stolen credentials from cloud services, containers, and developer tools
• •Shows significant overlap with TeamPCP threat actor but lacks cryptocurrency mining component, suggesting possible affiliation with a former TeamPCP member