Google's Threat Intelligence Group (GTIG) disclosed on 8 September that a financially motivated threat actor it tracks as TeamPCP (also known as Altered Spider or UNC6780) used an AI coding chatbot, a single prompt, and a set of written agent instructions to plan, build, and run a mass credential-harvesting campaign in under six hours — with no human operator working through the steps by hand. The AI agents scanned for vulnerabilities, wrote and deployed exploit code, troubleshot failures in real time, rotated IP addresses to dodge detection, and routed attack traffic through already-compromised legitimate cloud accounts. Google found the resulting dashboard organizing more than 23,800 stolen credentials for cloud platforms, AI services, and developer tools.
TeamPCP's method is what makes this one worth watching even if you've never heard of the group: rather than attacking a target company directly, it compromises widely-used open-source developer tools that already run inside that company's build pipeline — past targets include the Aqua Security Trivy scanner, the Bitwarden CLI package on npm, a Checkmarx Jenkins plugin, and GitHub itself — then harvests the elevated secrets that CI/CD systems must hold to function. Its credential stealer, tracked as DUSTMAKER, drops files into hidden project folders such as .claude and .cursor, the same folders many AI coding assistants use for their own configuration, so it reads as ordinary developer clutter rather than obvious malware.
What this means for your business
If your team or agency uses AI coding assistants and pulls packages from npm, PyPI, or Docker Hub, treat any unexpected file inside a .claude, .cursor, or similar hidden config folder as something to investigate, not routine clutter to ignore. Rotate CI/CD and cloud secrets on a set schedule rather than only after a breach is suspected — this campaign's entire premise was that harvested credentials get validated and reused within hours. Pin dependency versions on build tooling like scanners, linters, and CI plugins, and review changes before auto-upgrading, since supply-chain attacks specifically target the tools meant to keep you safe. And it's worth asking whoever manages your hosting or CI pipeline one direct question this week: would they notice unusual outbound traffic from a "legitimate" cloud account being used to relay someone else's attack?