S9041 TeamPCP Cloud Stealer
malwareEnterpriseplatformsContainers · Linux · macOS · SaaS · Windows
also known asTeamPCP Cloud Stealer · SANDCLOCK
The TeamPCP Cloud Stealer is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The TeamPCP Cloud Stealer was the primary payload used by TeamPCP in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.
techniques used (48)
ATT&CK techniques this enables or maps to.
used by groups (1)
Threat groups associated with this.
source
Where this definition is published.
Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan