Aikido TeamPCP Telnyx MAR 2026

TeamPCP has hidden malicious payloads in the frame data of WAV audio files.

TeamPCP has cloned GitHub commit metadata including the author name, email, committer, and timestamps to use for impostor commits. TeamPCP has also used legitimate file names such as msbuild.exe and ringtone.wav to mask malicious payloads.

TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.

TeamPCP has compromised credentials associated with open source security scanning tools and used them to push malicious code to all the resources the tools had access to.

TeamPCP has modified legitimate software binaries to retrieve secondary payloads from C2.

TeamPCP has compromised VS Code and Open VSX IDE extensions.

TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.

TeamPCP has conducted coordinated supply chain attacks targeting open-source developer infrastructure including the NPM, VS Code, Docker, and PyPi ecosystems to compromise multiple software packages.

CanisterWorm has spread through an automated process that infects and publishes npm packages.

TeamPCP has dropped malware into the Windows Startup folder to establish persistence.

CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.

TeamPCP has used stolen access tokens to inject malicious code into CI/CD workflows and to exfiltrate sensitive data from cloud, developer, and container environments.

TeamPCP has used malware to exfiltrate cloud secrets from targeted environments including AWS, GCP, and Azure.

TeamPCP has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed malware.

TeamPCP has set up Clouflare Tunnels for malware C2. TeamPCP has also used the session messenger network for decentralized, encrypted exfiltration via  *.getsession[.]org to recipient  ID `05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026`.

TeamPCP has compromised trusted CI/CD pipelines by injecting credential-stealing payloads into legitimate workflows and software packages including open-source security tools Trivy and KICS, and AI gateway LiteLLM.

CanisterWorm has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.