Two Australian men arrested in alleged TeamPCP hacking probe

KUALA LUMPUR, WESTERN AUSTRALIA, 28 AUGUST 2026 —

Two Alleged ‘TeamPCP’ Hackers Held in Australia, Tied to Global Software Supply Chain Attacks

The arrests follow a months-long investigation into TeamPCP, a group known for embedding malicious code in open-source software tools and extorting victims for profit. According to the AFP, the suspects are linked to a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses."

The AFP’s statement did not specify the charges or the timeline of the arrests, but cybersecurity journalist Brian Krebs reported that the 21-year-old suspect’s identity was uncovered in June. Krebs has maintained communication with the suspect since then. TeamPCP’s operations have spanned at least nine months, with the group targeting developers, cloud environments, and AI infrastructure through a self-propagating worm named Shai-Hulud.

---

A Cycle of Exploitation and Recruitment

TeamPCP emerged in late 2025, gaining notoriety for compromising corporate cloud environments by injecting malicious code into widely used open-source tools. The group’s tactics relied heavily on phishing and credential theft, allowing them to hijack repositories on platforms like GitHub and NPM. Once inside, they modified legitimate software tools, which were then downloaded by unsuspecting developers, perpetuating a cycle of exploitation.

Journalist Andy Greenberg, writing for Wired, described TeamPCP’s method as a "cyclical exploitation of software developers." The group would breach a network hosting an open-source tool, plant malware, and then use stolen credentials to publish malicious versions of other tools. This allowed them to expand their reach exponentially, infiltrating networks that relied on compromised software.

In May, TeamPCP escalated its operations by releasing the third iteration of Shai-Hulud and launching a recruitment contest. Participants were offered $1,000 in Monero (XMR) for conducting the largest supply chain attack using the worm’s code. The contest incentivized targeting popular code libraries, with participants scored based on the number of downloads of compromised packages.

Security firm Dataminr noted that the contest served as a recruitment tool, with TeamPCP offering to purchase "meaningful access" harvested from participants’ campaigns. The prize was dismissed by the group as a "participation trophy," with promises of higher payouts for successful breaches.

---

High-Profile Targets and Stolen Data

TeamPCP’s attacks have had far-reaching consequences. In March, the group compromised LiteLLM, an open-source AI gateway used to connect to over 100 large language models. A subsequent analysis by CloudSEK revealed that the attack harvested cloud service keys and other secrets from more than 2,500 organizations, including some of the world’s largest technology companies.

In May, TeamPCP claimed responsibility for breaching at least 3,800 code repositories on GitHub, owned by Microsoft. The intrusion began after a GitHub developer installed a compromised code extension. Security experts have described TeamPCP not as a single structured group but as a loose coalition of threat actors from multiple cybercriminal gangs, occasionally collaborating toward shared objectives.

Austin Larsen, a principal threat analyst with Google Threat Intelligence Group, noted that TeamPCP operates more like a "peer community of individually skilled actors" with a central figure pulling the strings. That figure is believed to be George Prepakis, a security researcher who operates the Twitter/X account @kernelstub. Prepakis created a Matrix chat server called Cybercats, which has become a hub for communication among TeamPCP members and other cybercriminal entities.

---

Connections to Malaysian Cybersecurity Concerns

While TeamPCP’s primary operations have targeted global entities, the group’s activities have implications for Malaysia, where digital transformation and reliance on open-source software are growing. Local cybersecurity firms have warned of the risks posed by supply chain attacks, which can compromise entire ecosystems of businesses and government agencies.

Malaysia’s Cybersecurity Malaysia (CSM) has previously highlighted the vulnerability of open-source software in its annual reports, noting that supply chain attacks can have cascading effects on critical infrastructure. The arrest of TeamPCP members may provide temporary relief, but experts caution that similar groups could emerge, exploiting gaps in software development and distribution chains.

Regional cybersecurity agencies, including Singapore’s Cyber Security Agency (CSA) and Indonesia’s BSSN, have also emphasized the need for stronger collaboration in combating such threats. The arrests in Australia underscore the transnational nature of cybercrime, requiring coordinated responses across Southeast Asia.

---

Stakeholder Perspectives and Industry Reactions

Industry stakeholders have reacted cautiously to the arrests. A spokesperson for the Malaysia Digital Economy Corporation (MDEC) stated that while the development is positive, it serves as a reminder of the ongoing threat posed by cybercriminals. "Supply chain attacks are a global challenge, and Malaysia must continue to invest in cybersecurity measures to protect its digital economy," the spokesperson said.

Cybersecurity firm F-Secure Malaysia echoed this sentiment, noting that the arrests may disrupt TeamPCP’s operations temporarily but do not eliminate the risk of similar attacks. "Cybercriminals often regroup or rebrand after such takedowns. Businesses must remain vigilant and adopt proactive security measures," a representative said.

The arrests have also drawn attention to the role of social media and encrypted communication platforms in facilitating cybercrime. TeamPCP’s use of Twitter/X, Telegram, and Matrix chat servers highlights the challenges faced by law enforcement in tracking and dismantling such networks.

---

The Role of Cybercats and Alleged Associates

The Cybercats Matrix server, created by George Prepakis (@kernelstub), has been a key communication channel for TeamPCP and other cybercriminal groups. The server’s member roster includes individuals associated with multiple threat actors, including Fulcrumsec, a group that has claimed responsibility for extortion attacks against pharmaceutical giant Novo Nordisk, data broker LexisNexis, and Avnet, a Fortune 500 distributor.

One of the arrested suspects, identified by KrebsOnSecurity as @pcpcasper, is linked to the National Socialist Network, a neo-Nazi organization based in Australia. Investigators allege that @pcpcasper shared content placing them in Western Australia, aligning with the location of the arrests.

Another suspect, identified as T or @pcpcats, was described as the self-proclaimed spokesperson for TeamPCP. @pcpcats had been active in the Cybercats chat but reduced their online presence in recent months, with other members expressing concern over their erratic behavior, which they attributed to substance use.

---

Forward-Looking: A Persistent Threat

The arrests of the two alleged TeamPCP members mark a significant step in disrupting one of the most prolific cybercrime operations in recent years. However, experts warn that the threat posed by supply chain attacks remains acute. The use of open-source software, while beneficial for innovation, also presents vulnerabilities that cybercriminals are quick to exploit.

For Malaysia and the broader ASEAN region, the incident serves as a call to action. Strengthening cybersecurity frameworks, enhancing collaboration between public and private sectors, and investing in threat intelligence capabilities will be critical in mitigating future risks.

As the investigation continues, authorities in Australia are expected to provide further details on the charges and potential extradition processes. For now, the arrests offer a momentary respite in a relentless cyber threat landscape, but the fight against such groups is far from over.

Related: Cybersecurity Malaysia (CSM) · George Prepakis