Dark Web Profile: TeamPCP

**TeamPCP executed a large, multi-ecosystem 2026 supply-chain campaign that poisoned CI/CD tooling (notably Trivy and Checkmarx), npm and PyPI packages, and abused runner environments to harvest ~500,000 credentials and exfiltrate 300+ GB (including EU Commission data); the report provides timelines, technical TTPs (credential theft, imposter commits, WAV steganography, privileged DaemonSets), MITRE ATT&CK mappings, IoCs (domains, IPs, commits, service names), and defensive lessons focused on identity and CI/CD security.**