PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems

PCPJack is a newly disclosed credential-theft framework that targets exposed cloud and container infrastructure (Docker, Kubernetes, Redis, MongoDB, RayML and vulnerable web apps). Operators use a bootstrap script and six Python payloads (orchestrator, parser, lateral movement, crypto utility, cloud ranges, and cloud scanner) to harvest and encrypt credentials, exploit known CVEs for propagation, and exfiltrate data via Telegram C2; the campaign appears financially motivated and exhibits worm-like lateral spread with ties to the TeamPCP cluster.