TeamPCP Supply-Chain Campaign Against AI and Security Tooling (Trivy, Checkmarx, LiteLLM) (2026)

Incident Summary

Between late February and April 2026, a financially motivated threat group operating as TeamPCP — tracked by the Google Threat Intelligence Group as UNC6780 — executed a multi-stage supply-chain campaign targeting widely deployed security and AI tooling.^[1][2] The campaign compromised the Trivy and Checkmarx KICS vulnerability scanners, the BerriAI LiteLLM AI gateway, Telnyx, the Bitwarden CLI, and the xinference inference server, distributing a credential-stealer payload named SANDCLOCK.^[5]

On March 23, 2026, the operators published BerriAI LiteLLM versions 1.82.7 and 1.82.8 to PyPI containing a malicious file named litellm_init.pth. Python’s site-packages auto-execution semantics meant the payload ran on any Python process startup regardless of whether LiteLLM was imported, making detection difficult.^[3]

Reporting by Palo Alto Unit 42, Datadog Security Labs, the SANS Institute, and Google GTIG confirmed that PyPI publishing tokens for LiteLLM were likely harvested during the earlier Trivy compromise, and that Cisco source code was exfiltrated via the Trivy-linked breach. A second wave in April 2026 added Checkmarx KICS, Bitwarden CLI, and xinference to the victim list.^[4][5][6]

This was primarily a software supply-chain campaign with material AI-ecosystem exposure rather than a campaign designed specifically around AI targets. BerriAI LiteLLM and xinference were directly affected, while the compromises of Trivy and Checkmarx KICS could also reach AI/ML development pipelines that rely on those scanners. The remaining victims, Telnyx and the Bitwarden CLI, are general software infrastructure.

Key Facts

• Threat actor: TeamPCP (financially motivated); tracked by GTIG as UNC6780
• Payload: SANDCLOCK credential stealer
• AI-ecosystem victims: BerriAI LiteLLM, xinference; downstream AI/ML pipelines relying on Trivy and Checkmarx scanners
• Key technical novelty: Use of a .pth file executed by Python’s site-packages loader, running on every Python process regardless of import
• Reported exfiltration: Source code involving Cisco, via the Trivy-linked breach (source-reported; not independently confirmed by Cisco in the cited material)
• Evidence note: The campaign and the affected package releases are confirmed. Some cross-victim linkage, the precise access paths between compromises, and downstream exposure assessments remain source-reported.
• Basis for sector-wide impact: Named victims span vulnerability scanning, AI gateway/inference, telephony, and secrets management, with the affected packages distributed through PyPI to large downstream install bases. The label reflects breadth across the tooling ecosystem rather than a measured count of affected organizations.
• Distribution vector: Malicious PyPI releases and poisoned pull requests
• Detection sources: Datadog Security Labs (initial), Palo Alto Unit 42, SANS Institute, Google GTIG

Threat Patterns Involved

Primary: AI Supply-Chain Attack — Compromise of widely deployed AI tooling (LiteLLM, xinference) and of the security scanners used to validate AI/ML codebases, with the payload propagating downstream to every consumer of the affected packages.

No secondary pattern is assigned. The campaign used conventional supply-chain tradecraft: harvested publishing tokens, malicious pull requests, and a .pth file abusing Python’s site-packages loader. Whether the operators used AI-assisted tooling to author those pull requests or scale targeting is recorded below as an open question, not as a finding.

Significance

TeamPCP is a watershed campaign for AI ecosystem supply-chain risk:

1. Security tooling as the attack surface: Vulnerability scanners and AI gateways — products explicitly trusted to inspect or route code — were converted into the delivery mechanism. The defenders’ own infrastructure became the initial-access vector.
2. Cascading compromises: Credentials harvested from one victim (Trivy) were used to compromise the next (LiteLLM), demonstrating how a single break in the AI/security tooling chain compounds across the ecosystem.
3. Stealth via Python loader semantics: The .pth execution technique sidesteps the common defender assumption that “malicious code only runs if the package is imported,” undermining a generation of triage heuristics.
4. AI tooling is now a high-value criminal target: LiteLLM and xinference are core components of many enterprise AI deployments. Their inclusion confirms that the AI build chain is no longer adjacent to threat-actor priorities — it is central.