Three consecutive releases of Microsoft’s official Python workflow SDK were poisoned with a multi-cloud credential-stealing worm, continuing the group’s relentless 2026 supply chain campaign.
The TeamPCP threat group has struck again this time targeting durabletask, the official Microsoft Python client for the Durable Task workflow execution framework.
Security researchers at Wiz disclosed that versions v1.4.1, v1.4.2, and v1.4.3 of the package were compromised and contained a worm-like malware payload. PyPI has since quarantined all three versions following Wiz’s analysis.
TeamPCP (also tracked as PCPcat and DeadCatx3) has been one of the most active supply chain threat actors of 2026.
Their campaign, codenamed Mini Shai-Hulud, began in early March with the compromise of Aqua Security’s Trivy scanner, then cascaded to Checkmarx GitHub Actions, LiteLLM, Telnyx, and dozens of npm packages.
Most recently, the group compromised more than 300 packages across the @antv npm ecosystem on May 19, 2026.
Wiz Research said in a report shared with Cyber Security News that the durabletask attack occurred just days after the group compromised guardrails-ai on May 11, with the infection chain traced back to the previously reported @antv wave.
A GitHub user account implicated in that wave was identified as having also targeted the microsoft/durabletask-python repository, with attack activity logged between 15:08 UTC and 15:16 UTC.
During this window, the attacker copied the latest legitimate commit message from the main branch to disguise malicious activity.
The attacker had compromised the GitHub account through an earlier operation, then dumped GitHub Secrets from repositories the account had access to.
Among those secrets was a PyPI publishing token, which granted direct ability to push malicious releases to the official PyPI registry, bypassing code review entirely.
The dropped malware, rope.pyz, is a direct evolution of transformers.pyz used in the guardrails-ai compromise.
The payload targets Linux systems only and injects itself across multiple entry points : task.py, entities/__init__.py, extensions/__init__.py, and payload/__init__.py , giving it more execution paths than prior versions.
Once triggered, the malware performs a sweeping credential theft operation, targeting:
.bash_history, .zsh_history) for additional secrets.The worm then propagates via AWS SSM and Kubernetes lateral movement, spreading to up to five additional targets per infected host.
The C2 infrastructure has also matured, shifting from raw IP to domain-based servers (check.git-service.com with backup t.m-kosche.com), with SSL verification now enabled.
| Type | Indicator |
|---|---|
| C2 Domain (Primary) | check.git-service[.]com |
| C2 Domain (Secondary) | t.m-kosche[.]com |
| Payload File | /tmp/rope-*.pyz |
| Infection Marker (General) | ~/.cache/.sys-update-check |
| Infection Marker (K8s) | ~/.cache/.sys-update-check-k8s |
| Hash – rope.pyz | 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce |
| Hash – durabletask-1.4.1.whl | 7d80b3ef74ad7992b93c31966962612e4e2ceb93e7727cdbd1d2a9af47d44ba8 |
| Legacy C2 IP | 83.142.209.194 |
[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.What Security Teams Must Do Now:
Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Microsoft has pushed out an emergency, out-of-band Windows 11 update after its September Patch Tuesday…
CDR is the runtime, real-time half of cloud security: while CSPM tells you what’s misconfigured,…
Your SaaS estate M365, Salesforce, Workday, Slack, hundreds of others is a sprawl of misconfigurations,…
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…