Google put a mole inside TeamPCP and watched history's worst supply-chain hack from inside

TeamPCP tainted hundreds of open-source programs with malware, hijacked developer credentials to plant its code in yet more widely used tools, and automated the cycle with a Dune-themed self-spreading worm — compromising targets from the security scanner Trivy and the AI tooling of LiteLLM and Mistral AI to GitHub, Mercor, OpenAI employee devices and the European Commission. Google's Mandiant unit, it revealed in September 2026, had an undercover analyst inside the group's inner circle from almost the beginning.

The persona had spent months building trust with an actor invited into TeamPCP, and was added to the core CanisterWorm chat — one of about a dozen members — and reached the server where stolen credentials were stockpiled for extortion. 'Essentially, almost day one, Mandiant was watching everything behind the scenes,' Google Threat Intelligence Group's Austin Larsen told WIRED.

Rather than alerting the owners of thousands of stolen credentials directly, which would have taken too long, Google first went to service providers to break the criminals' access at scale, and followed the operational-security mistakes of alleged leaders to hand law enforcement identifying details. Intelligence also arrived from ShinyHunters, a rival criminal group that turned on its partner.

Mandiant spent months growing an online persona until TeamPCP invited it into the inner circle — then warned victims by going to providers, not companies.

A trusted persona inside the group converts threat intelligence from after-the-fact forensics into live visibility of targets and plans.

Provider-level credential resets fix thousands of victims with a handful of actions, outrunning the extortion clock.

Tracing operational-security mistakes to named suspects turned monitoring into prosecution.

Rival-groups-turned-informants added coverage the mole alone could not provide.

Infiltration plus provider-side remediation beats victim-by-victim triage: when compromise outnumbers your capacity to warn, fix it upstream where one action covers thousands.

In August 2026 Australian police, working with the FBI, arrested and charged two alleged principal participants in TeamPCP, Ruben Ian Thomson and Louis Michael Gaebler. Larsen presented the infiltration at SentinelOne's LABScon conference on September 18, 2026.