New PCPJack worm steals credentials, cleans TeamPCP infections

**PCPJack: cloud-focused credential theft and cleanup of rival infections** — SentinelLabs reports a new Linux-based malware framework, PCPJack, that compromises exposed cloud services (Docker, Kubernetes, Redis, MongoDB, RayML, vulnerable web apps), removes TeamPCP artifacts, harvests credentials and SSH keys, moves laterally, establishes persistence (systemd, cron, Redis rewrites, privileged containers), exfiltrates encrypted credentials to Telegram, and deploys a Sliver-based backdoor; researchers link its tooling to a possible former TeamPCP affiliate and provide mitigation recommendations including MFA, IMDSv2, least-privilege, and avoiding plaintext secrets.