TeamPCP Defaces Aqua Security’s Internal GitHub Org

TeamPCP (aka DeadCatx3/PCPcat/ShellForce) used a stolen Argon-DevOps-Mgt personal access token — likely harvested via prior Trivy GitHub Actions tag poisoning — to execute an automated 2-minute defacement of Aqua Security's internal GitHub org (aquasec-com), renaming and publicizing 44 repositories and exposing internal source code, CI/CD configurations, and knowledge bases; the report includes timelines, IOCs (domains, C2 hosts, file paths, a hash), and remediation steps including immediate token revocation and secret rotation.