GTIG: attacker agentic pipelines — TeamPCP trojanized MCP servers, hidden .claude/.cursor malware, a 23,800-secret harvester dashboard

View raw markdownEdit on GitHub ↗

TL;DR

Google Threat Intelligence Group (GTIG) published its adversarial-AI tracker on 2026-09-08, and it is the first vendor-telemetry report to describe attackers running agentic pipelines rather than asking a chatbot for help. Three findings bear directly on this repo's readers: (1) the actor GTIG tracks as UNC6780 — TeamPCP, behind the Mini Shai-Hulud waves, is now shipping trojanized MCP servers (tiktoken_mcp, azure-functions-mcp-extension), extracting OIDC tokens from GitHub Actions runners to sign SLSA Build Level 3 attestations, hiding malware in .claude/, .vscode/, and .cursor/ directories, and placing prompt-injection text in its JavaScript loaders aimed at LLM-based security scanners; (2) in Q2 2026 a financially motivated actor compromised a cloud resource, then used "an AI coding chatbot, a prompt, and a set of agent instructions" (markdown playbooks) to plan, build, and run a mass credential-harvesting campaign — thousands of third-party credentials in under six hours; (3) an exposed C2 dashboard for a framework GTIG calls "Recon" held 23,800+ harvested secrets (API keys, cloud and AI-service credentials), configured through AGENTS.md/KNOWLEDGE.md-style agent files — the same instruction-file convention your own coding agent reads. GTIG's incident-response guidance now includes: assume threat actors have your developer IDE configurations.

What happened

GTIG's report (single primary source — Google's own telemetry, with Mandiant incident-response cases; The Hacker News' same-day coverage restates it) lays out a five-stage progression it says attackers have moved through in 2026: basic prompting → multi-stage prompt chains → agentic workflows (autonomous scanning, error resolution, credential harvesting) → AI integrated across the whole attack lifecycle → fully autonomous pipelines with machine-speed vulnerability discovery, which it says it has observed "in limited cases." The specifics that matter here:

UNC6780 / TeamPCP — the supply-chain actor this repo already tracks, now with an MCP and agent-config toolkit

GTIG attributes the TeamPCP / Mini Shai-Hulud campaign (March 2026 – ongoing, PyPI/npm/Docker Hub) to UNC6780 and names its credential stealer DUSTMAKER. New in this report, relative to what this repo had from vendor IR posts:

  • Trojanized MCP servers as a distribution vector, with tiktoken_mcp and azure-functions-mcp-extension named — MCP packages impersonating real tooling, the same lane as Deadbugz and the malicious-MCP-registry findings.
  • OIDC token extraction from GitHub Actions runners to sign attestations — which is how compromised packages arrived with valid SLSA Build 3 provenance, the "provenance was real, the package was still malicious" problem first seen in the @7nohe/openapi-react-query-codegen compromise.
  • Prompt injection inside the JavaScript loaders, targeting LLM-based security scanners. The payload carries text meant for the analyst's AI, not the victim's — the same anti-triage move as the Hades campaign's "AI analyst misdirection".
  • Hidden-directory malware and config hijacking for persistence in .claude/, .vscode/, and .cursor/ — dropped where an AI coding tool will read them and where a human ls won't show them. Compare TrapDoor and the Claude Code MCP OAuth hijack.

Mass credential harvesting, built by an agent, in under six hours

GTIG's headline case: in Q2 2026 an actor compromised a cloud resource, then leveraged "an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours." The tooling was a multi-agent architecture with markdown instruction sets as operational playbooks, autonomous vulnerability scanning, and IP-rotation logic — no manual intervention between steps. GTIG does not name the victim, the chatbot, or the exact credential count beyond "thousands of third-party credentials."

"Recon" — a credential-harvesting dashboard with 23,800+ secrets

Google found an exposed command-and-control server running a production dashboard for an automated reconnaissance framework it calls "Recon," holding 23,800+ secrets — API keys, cloud credentials, and AI-service credentials — with the framework configured through files named AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md. GTIG frames it as the shift from passive endpoint infostealers to offensive agentic harvesting: the infostealer output becomes the seed list for an agent that goes and uses the keys.

Everything else in the report

  • UNC6508 (PRC-nexus) targets North American academic, medical, and military AI research for model weights and source code — and deploys local open-weight LLM infrastructure inside compromised cloud environments to avoid commercial-API monitoring while using the victim's compute (Mandiant saw requests for 48-vCPU instances and NVIDIA RTX 6000 quota).
  • Model distillation campaigns against Gemini exceeded 100 million prompts in Q2, run through proxy infrastructure with thousands of compromised credentials and account rotation.
  • Extortion cases where the stolen assets were proprietary AI models, prompts, skills, and model scripts at a healthcare company and an AI media-generation company.
  • Tools GTIG saw abused or built by actors: Gemini, Claude, Codex, DeepSeek-Coder; Cursor, Cline, Continue, Gemini CLI; a LiteLLM proxy; the Manus agent framework; and actor-built tooling named CC Switch (LLM orchestration), Phalanx (autonomous pentest), and Recon.

Am I affected?

This is a threat-landscape report, not a single incident with an IOC list, so "affected" means "in the target set." You are if you:

  • Publish to npm/PyPI/Docker Hub from GitHub Actions with OIDC trusted publishing — GTIG documents runner-side OIDC token theft used to sign provenance.
  • Run MCP servers you installed by name rather than by audited source. Check for the two named packages:
grep -ri 'tiktoken_mcp\|azure-functions-mcp-extension' ~/.claude/settings.json ~/.cursor/mcp.json ~/.codex/config.toml ~/.vscode/ 2>/dev/null
pip list 2>/dev/null | grep -i 'tiktoken.mcp\|azure.functions.mcp'
npm ls -g 2>/dev/null | grep -i 'tiktoken-mcp\|azure-functions-mcp'
  • Keep AI-platform API keys on a workstation that has ever run an infostealer — GTIG names LUMMAC.V2, STEALC.V2, VIDAR, and ACRSTEALER as the feeders; the same families are behind the Claude.ai session-hijack wave.
  • Have a hidden .claude/, .cursor/, or .vscode/ directory in a project you did not create:
find . -maxdepth 3 -type d \( -name .claude -o -name .cursor -o -name .vscode \) -newer package.json 2>/dev/null
git status --ignored --short | grep -E '\.(claude|cursor|vscode)/'

If you are affected

Prevention

  • prevention/ci-cd-hardening.md — OIDC trusted publishing is only as strong as the runner; a compromised job step can mint the same token your release job does. Pin actions, scope id-token: write to the one job that publishes, and treat provenance as "the build ran," not "the build was honest."
  • prevention/mcp-hygiene.md — install MCP servers from audited source, not by searching a registry for a plausible name.
  • prevention/credential-hygiene.md — AI-service keys are now a first-class infostealer target and a first-class agent target. Short-lived tokens; no long-lived keys in .env files on laptops.
  • Assume your agent instruction files are read by attackers and written by them. GTIG's actor configured its harvester with AGENTS.md; TeamPCP drops payloads into .claude/. The convention that makes your coding agent useful is the same one that makes it steerable.

Sources