TeamPCP pivots from stolen logins to AI model extortion

A financially motivated group tracked as UNC6780, publicly known as TeamPCP, spent February through May 2026 breaching PyPI, npm, and Docker Hub, according to a mitigation advisory from Google's Threat Intelligence Group and Mandiant. The group abused GitHub Actions' pull_request_target trigger to grab base-repository secrets and write access, then deployed credential stealers, including one called SANDCLOCK, to collect high-value secrets.

Mandiant's incident responders told reporters that the same group has since pivoted from selling stolen credentials to a new business model: exfiltrating proprietary AI models, training data, and source code from compromised organizations, then demanding payment to keep the material private rather than releasing or reselling it.

Google's chief threat analyst, John Hultquist, said the shift tracks with how much companies have sunk into their AI systems: they don't want that investment exposed, so they pay, regardless of whether the initial access traces back to a compromised open-source package.

For anyone running CI/CD against public registries, the mechanics matter more than the ransom angle. UNC6780's initial access came from ordinary GitHub Actions misconfigurations, not a novel exploit. Auditing which workflows trigger on pull_request_target, and treating any pipeline secret as reachable through a compromised third-party dependency, closes the same door this group has been using since February.

Correction, October 23, 2026: an earlier version of this item attributed the extortion pivot to Google's advisory and said SANDCLOCK ran across thousands of pipeline runs. The pivot comes from Mandiant's comments to reporters, and the advisory gives no run count.