Google Mole Unmasks Massive Hacker Group

Google's threat intelligence group, through an undercover analyst, infiltrated the hacker collective known as TeamPCP during its extensive supply chain attacks. This operation allowed Google to monitor the group's activities, warn potential victims, and actively disrupt their exploits.

TeamPCP engaged in widespread hacking, compromising hundreds of open-source programs and stealing developer credentials to further infiltrate software supply chains. The group even utilized a Dune-themed worm to automate its expansion, ultimately affecting over a thousand companies. Among its notable targets were Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI.

During March 2026, a Google analyst gained access to TeamPCP's core chat, CanisterWorm, providing real-time insights into their operations. This intelligence enabled Google to notify providers like AWS and Microsoft to revoke stolen credentials, thwarting TeamPCP's extortion attempts. The group also allegedly used AI to develop a zero-day exploit targeting login software, which Google helped patch.

Further complications arose when TeamPCP partnered with the ShinyHunters group, which then betrayed them by extorting victims without sharing profits. This betrayal led to TeamPCP narrowing its circle and expelling members, including Google's analyst. However, through diligent digital detective work, Google identified one of TeamPCP's alleged leaders, leading to his arrest in late September 2026.

Google's involvement highlights a shift towards proactive disruption, with its Cyber Disruption Unit now focused on aggressively combating cybercrime. The undercover analyst maintained strict ethical boundaries, acting as an observer rather than a participant in illegal activities.