New PCPJack worm steals credentials, cleans TeamPCP infections
… Among the targeted services are Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. …
Tracked topic
… Among the targeted services are Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. …
… Organizations operate hybrid infrastructures spanning on-premises systems, multi-cloud platforms, containers, and Kubernetes clusters, all while navigating strict compliance requirements from frameworks including PCI DSS, HIPAA, GDPR, NIST 800-53, and CIS Benchmarks. …
… The behavior resembles the CanisterWorm campaign that TeamPCP deployed in March and targeted Kubernetes platforms. …
… An analysis of the JavaScript payload revealed that it targeted a broad range of developer secrets that included the following: GitHub tokens and GitHub Actions secrets npm, PyPI, RubyGems, JFrog publishing tokens AWS, GCP, Azure, Kubernetes, and Vault credentials SSH keys Docker credentials .env, … …
… The latest compromise appears to be the work of an external actor who compromised the account of an inactive maintainer named 'atiertant.' According to the researchers, the infostealer injected in the new node-ipc versions collects the following types of information from compromised systems: Cloud … …
… The framework harvests credentials from cloud providers, CI/CD systems, password managers, Kubernetes, and secret stores, and abuses them to compromise npm, PyPI, and RubyGems packages, as well as GitHub repositories, Actions workflows, and JFrog Artifactory instances. …
… The Mini Shai-Hulud malware delivered in the campaign targeted the theft of developer and cloud credentials, including GitHub tokens, npm publish tokens, AWS credentials, Kubernetes secrets, SSH keys, and .env files. …
… The downloaded PHP payload VirusTotal was a large cross-platform credential stealer for Linux, macOS, and Windows that harvests cloud credentials, Kubernetes secrets, Vault tokens, Git credentials, CI/CD secrets, SSH keys, browser data, cryptocurrency wallets, password managers, VPN configurations,… …
… The poisoned extension deployed a malicious payload designed to steal credentials and secrets for a wide range of platforms, including npm, AWS, Kubernetes, GitHub, and GCP/Docker. …
… "scripts": { "preinstall": "node index.js" } According to Aikido, the 'index.js' payload was approximately 4.2 MB in size, and is used to steal GitHub Actions secrets, AWS credentials, Google Cloud credentials, Azure service principal credentials, HashiCorp Vault tokens, Kubernetes service account … …