Glossary term
Infostealer
An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker.
Read more
Malware profile
TeamPCP Cloud Stealer
Also known as SANDCLOCK
TeamPCP Cloud Stealer is a credential stealer that checks more than 50 file paths on build servers, cloud accounts and developer machines.
In short
TeamPCP Cloud Stealer is a credential stealer that checks more than 50 file paths on build servers, cloud accounts and developer machines. It encrypts what it finds and sends it out, with a fallback that uses the victim's own GitHub account. MITRE says TeamPCP used it as its main payload in March 2026, and the FBI uses the name SANDCLOCK for the same tool.
- Names2names in public reportsTeamPCP Cloud Stealer · SANDCLOCK
- Techniques20ATT&CK techniques listedCredential Access · Execution · Persistence
- Infection Steps5in the delivery chainTampered component runs · Secrets are collected
- Linked Groups1groups that use itTeamPCP
In one minute
- What it is
- A credential stealer that harvests secrets from more than 50 file paths in CI/CD, cloud, developer and container environments and sends them out encrypted.
- What it does
- Reads secrets from the memory of the build runner, collects SSH keys, cloud and Kubernetes credentials and cryptocurrency wallet data, and exfiltrates them, with GitHub as a fallback route.
- Who uses it
- Attributed by the FBI (FLASH-20260702-01, 2 July 2026) to the group TeamPCP, under the name SANDCLOCK. MITRE lists TeamPCP as the group that uses it, and BSI (26 March 2026) says TeamPCP is reported to be behind the Trivy attacks.
- How it gets in
- Tampered software that people trust: poisoned Trivy releases and GitHub Action tags in March 2026, run inside CI/CD pipelines.
- What to do first
- Pin GitHub Actions to full commit hashes, treat any runner that used an affected version as compromised, and rotate every secret it could reach.
What it does
MITRE describes TeamPCP Cloud Stealer as a filesystem credential stealer for CI/CD, cloud, developer tooling and container environments. It reads the memory of the GitHub Actions runner process, searches for keys, tokens and cryptocurrency wallets, and bundles the result before sending it out.
The Trivy project advisory shows how it reached victims: the code ran inside tampered Trivy components, before the real security scan. The FBI says the same actor also compromised other developer tools, and that stolen credentials can be used long after the first compromise.
The FBI lists SANDCLOCK among four tools TeamPCP deployed, and describes it as a credential stealing tool that extracts AWS credentials, Kubernetes ServiceAccount tokens, local environment variables and cryptocurrency wallet data.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| TeamPCP Cloud Stealer | MITRE ATT&CK software S9041[1] |
| SANDCLOCK | MITRE alias for S9041, and the name used for the same tool in FBI FLASH-20260702-01[1, 2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Credential Access
OS Credential Dumping: Proc Filesystem T1003.007
It reads the memory of the GitHub Actions runner process to pull out secrets, including plaintext tokens.[1, 3]
Steal Application Access Token T1528
It extracts plaintext tokens from the memory of the runner process.[1]
Unsecured Credentials: Credentials In Files T1552.001
It checks more than 50 file paths for credentials in CI/CD, cloud and container environments.[1, 3]
Unsecured Credentials: Container API T1552.007
It can query the Kubernetes API to get credentials.[1]
Credentials from Password Stores: Cloud Secrets Management Stores T1555.006
It looks through several file paths for AWS, GCP and Azure access credentials.[1]
Credentials from Password Stores T1555
It can take credentials from cryptocurrency wallets and key stores.[1]
Execution
Command and Scripting Interpreter: Unix Shell T1059.004
MITRE says it abused shell scripts inside GitHub Actions for discovery and credential harvesting. The Trivy advisory places the stealer in the entrypoint.sh script.[1, 3]
Command and Scripting Interpreter: JavaScript T1059.007
It has infected victims through pre-install and post-install scripts in package.json files.[1]
Container Administration Command T1609
It can run kubectl get secrets to take credentials from Kubernetes.[1]
Persistence
Stealth
Execution Guardrails T1480
It checks whether it runs on a developer machine rather than in GitHub Actions before running its persistence script.[1]
Obfuscated Files or Information: Encrypted/Encoded File T1027.013
It has used multi-stage payloads with double Base64-encoded scripts to avoid static analysis.[1]
Masquerading: Match Legitimate Resource Name or Location T1036.005
It has installed a backdoor named sysmon.py.[1]
Collection
Command and Control
Encrypted Channel: Asymmetric Cryptography T1573.002
It has encrypted collected data with a hybrid of RSA-4096 and AES-256 before sending it with curl.[1, 3]
Fallback Channels T1008
It posts data to an attacker domain and, if that fails, can use the victim's own GitHub account to create a public repository and upload the data as a release asset.[1, 3]
Exfiltration
Exfiltration Over Web Service: Exfiltration to Code Repository T1567.001
It can use the victim's own GITHUB_TOKEN to create a repository and upload stolen credentials.[1, 3]
Automated Exfiltration T1020
It compresses and encrypts data and posts it to an attacker-controlled domain without operator action.[1]
How it spreads
The Trivy project advisory says the attacker used compromised credentials to publish a malicious Trivy release, to force-push 76 of 77 version tags of the trivy-action GitHub Action to malicious commits, and to publish malicious container images on Docker Hub. MITRE adds that the stealer has infected victims through pre-install and post-install scripts in package.json files. The PyPI incident report says stolen tokens and keys let the attackers compromise further packages. The FBI says TeamPCP injected malicious code into legitimate packages and sent trojanized updates that looked normal.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Tampered component runs
In the Trivy action, the malicious code was injected into entrypoint.sh and runs before the real Trivy scan.[3]
Secrets are collected
It dumps Runner.Worker process memory and sweeps more than 50 file paths for SSH keys, cloud credentials, Kubernetes tokens, Docker configs, .env files, database credentials and cryptocurrency wallets.[3]
Data is encrypted
The collected data is encrypted with AES-256-CBC and RSA-4096 hybrid encryption.[3]
Data is sent out
It transmits the data to attacker-controlled infrastructure.[3]
Fallback route
If sending fails and a GitHub token is set, it creates a public tpcp-docs repository on the victim's GitHub account and uploads the stolen data as a release asset.[3]
Timeline
- 19 March 2026
Trivy release and Action tags poisoned
The Trivy project says an actor used compromised credentials to publish Trivy v0.69.4, force-push 76 of 77 trivy-action tags and replace all 7 setup-trivy tags.[3]
- 19 March 2026
European Commission AWS key taken
CERT-EU says an actor acquired an AWS secret of the European Commission through the Trivy compromise on 19 March, and launched TruffleHog the same day.[4]
- 22 March 2026
Malicious Trivy images on Docker Hub
The Trivy project says an actor published Trivy v0.69.5 and v0.69.6 images on Docker Hub using separately compromised credentials.[3]
- 24 March 2026
- 25 March 2026
GitHub advisory on LiteLLM
GitHub published an advisory for the two LiteLLM versions, linking them to an exploited Trivy dependency.[9]
- 26 March 2026
BSI warns of Trivy attack
BSI warning BITS-V 2026-237970-1032 describes the Trivy compromise and says TeamPCP is reported to be behind it.[6]
- 28 March 2026
Stolen Commission data published
CERT-EU says the group ShinyHunters released the exfiltrated dataset on its leak site.[4]
- 1 April 2026
CERT-EU cyber brief
CERT-EU cyber brief 26-04 covers the Trivy and LiteLLM compromises and attributes them to TeamPCP.[5]
- 2 July 2026
FBI FLASH names SANDCLOCK
The FBI lists SANDCLOCK among the malware deployed by TeamPCP in FLASH-20260702-01.[2]
Who uses it
Seen in
Detection and defense
Questions
What is TeamPCP Cloud Stealer?
MITRE describes it as a filesystem credential stealer that can harvest, encrypt and exfiltrate credentials from over 50 sensitive file paths in CI/CD, cloud, developer tooling and container environments.
Is SANDCLOCK the same tool?
MITRE lists SANDCLOCK as an alias of TeamPCP Cloud Stealer. The FBI describes SANDCLOCK as a credential stealing tool used by TeamPCP that extracts AWS credentials, Kubernetes ServiceAccount tokens, environment variables and cryptocurrency wallet data.
How did it reach victims?
The Trivy project says an attacker used compromised credentials to publish a malicious Trivy release and to move 76 of 77 trivy-action tags to malicious commits. The stealer ran before the real scan.
What should a team do after using an affected Trivy version?
BSI and the Trivy project say to assume compromise, treat reachable secrets as leaked and update to the safe versions. The FBI also asks for rotation of CI/CD secrets, publishing tokens and cloud credentials.
Does any source link it to the LiteLLM incident?
LiteLLM and CERT-EU say a credential stealer was in the two bad LiteLLM versions, and CERT-EU attributes that compromise to TeamPCP. None of the sources opened names the payload as TeamPCP Cloud Stealer.
What other malware does TeamPCP use?
The FBI lists CanisterWorm, a credential harvester for cloud services, Mini Shai-Hulud, a self-replicating worm across npm and PyPI, and Miasma, a variant of Mini Shai-Hulud, alongside SANDCLOCK.
Which tools did TeamPCP tamper with?
The FBI names Trivy, KICS, LiteLLM and the Telnyx Python SDK, and says these are commonly part of CI/CD pipelines, cloud infrastructure and security workflows.
How can a team tell if the fallback route was used?
The FBI says to search GitHub organization repositories for repositories named tpcp-docs or docs-tpcp, which are created using stolen credentials.
Why rotate secrets even after cleaning up?
The FBI says stolen data and credentials are a persistent risk and that affiliated actors are likely to use them long after the first compromise.
In our research
- TeamPCP Threat group
Sources
- TeamPCP Cloud Stealer, Software S9041 MITRE ATT&CKSupports: Description, alias SANDCLOCK, platforms, techniques and the link to TeamPCP.
- FBI FLASH-20260702-01, Cyber Criminal Group TeamPCP FBI, IC3Supports: Lists SANDCLOCK as TeamPCP malware, the recommendations and the indicator tables.
- Trivy ecosystem supply chain temporarily compromised, GHSA-69fq-xp46-6x23 Trivy project, GitHub security advisorySupports: Dates, affected components, what the injected stealer does.
- European Commission cloud breach: a supply-chain compromise CERT-EUSupports: Initial access through the Trivy compromise, timeline and recommendations.
- Cyber Brief 26-04, March 2026 CERT-EUSupports: Trivy and LiteLLM compromises attributed to TeamPCP.
- Trivy: Supply-Chain Angriff führt zu Kompromittierungen in Deutschland, BITS-V 2026-237970-1032 BSISupports: German warning of 26 March 2026 on the Trivy attack and affected versions.
- Security Update: Suspected Supply Chain Incident LiteLLMSupports: Maintainer disclosure of the two bad versions and the credential stealer.
- Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance PyPI blogSupports: Registry timeline, exposure time and dependency cooldowns.
- Two LiteLLM versions published containing credential harvesting malware, GHSA-5mg7-485q-xm76 GitHub Advisory DatabaseSupports: Advisory published 25 March 2026, link to an exploited Trivy dependency.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.