Google Had an Undercover Analyst Inside the TeamPCP Supply-Chain Hacking Group

While the hacker group TeamPCP was poisoning open-source software this spring, Google had someone inside its private chat. Austin Larsen, a researcher with Google Threat Intelligence Group, laid out the operation at SentinelOne’s LABScon conference, WIRED reported.

“One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group,” Larsen told WIRED. “So essentially, almost day one, Mandiant was watching everything behind the scenes.” The undercover analyst, who works for Google’s Mandiant unit and isn’t Larsen, was one of about 12 members with access to a core chat the group called CanisterWorm.

A spree built on stolen developer credentials

TeamPCP, which appears to have surfaced in late 2025, compromised open-source projects to plant malware, used that malware to steal developer credentials, and then used those credentials to taint the next widely used tool. Its targets included the Trivy security scanner, the LiteLLM API tool, Checkmarx infrastructure, the TanStack library and Mistral AI, and the chain eventually led to breaches at GitHub, Mercor and employee devices at OpenAI and the European Commission, according to WIRED. At times it used a self-spreading worm called Mini Shai-Hulud. WIRED says the group ultimately breached more than a thousand companies.

The analyst gained access to a server where TeamPCP kept stolen usernames, passwords and access tokens. Rather than contact every victim first, Larsen’s team went to providers such as Amazon Web Services and Microsoft to get the credentials revoked, then sent hundreds of notifications to providers and victims. “Let’s go mess up what they’re doing. That was my goal,” Larsen said.

The inside view also revealed that a core member was using an AI tool to build a zero-day exploit that bypassed two-factor authentication in a widely used login product. Google tested the code, confirmed it worked with a few tweaks and warned the developer, which patched the flaw.

Partners turned rivals

Larsen estimates TeamPCP collected only tens of thousands of dollars in extortion payments, so it recruited other criminal groups to monetize the data for a cut. One partner, ShinyHunters, went rogue around April, ran its own extortions with TeamPCP’s credentials and even sent Larsen a full chat log, unaware Google already had access. TeamPCP responded by shrinking its inner circle and moving servers, which also pushed Google’s analyst out.

Traditional investigative work filled the gap, and Larsen said Google passed identifying details to the FBI. Two Australians described by the Australian Federal Police as “principal participants” in TeamPCP were arrested and charged in August in a joint investigation with FBI assistance.