Australian Police Arrest Two Alleged Members of TeamPCP Hacking Group
The Australian Federal Police announced on August 27, 2026 that it had arrested two men, aged 21 and 23, from Western Australia in connection with TeamPCP, a cybercrime group blamed for one of the longest-running software supply-chain attack campaigns on record. Investigators described the operation as a “sophisticated cybercrime syndicate” that embedded malicious code into widely used open-source software tools to compromise thousands of businesses worldwide. The pair face a combined 14 charges and appeared before a Perth court, with one denied bail and both due back in custody until a September 18 hearing.
TeamPCP rose to prominence in late 2025 by spreading a self-propagating worm known as Shai-Hulud through open-source package repositories such as npm and GitHub, using stolen developer credentials to plant malware that then harvested further credentials from downstream projects, allowing the campaign to spread from one compromised developer to the next. The group has been linked to a supply-chain compromise of the AI gateway tool LiteLLM that exposed cloud service keys belonging to more than 2,500 organizations, as well as a claimed breach of thousands of Microsoft-owned GitHub repositories. Researchers describe TeamPCP less as a single hierarchical gang than as a loosely connected network of individual hackers who coordinate through chat channels and have periodically run recruitment contests rewarding whoever compromises the most widely used code packages.
Investigative reporting that combined leaked forum data, reused email addresses, and social media activity linked the group’s self-described spokesperson to a Perth resident, who Australian media later confirmed was one of the two men taken into custody. Security researchers who have tracked the group say its case reflects an emerging category of threat actor that blends financial motive with a desire for attention and disruption, and that the availability of large language models has lowered the technical barrier for less experienced hackers to run large-scale campaigns. The group’s activity also pushed GitHub and other coding platforms to introduce new safeguards, including short delays before newly published package updates are automatically installed, intended to give defenders more time to catch compromised releases.