Loading malware…
SANDCLOCK is a credential-stealing malware payload associated with the financially motivated threat actor TeamPCP, also tracked as UNC6780. It has been used in large-scale software supply-chain compromises affecting developer and security tooling, particularly CI/CD workflows and build environments. Reported campaigns tied to SANDCLOCK include compromises involving Trivy-related GitHub Actions and downstream poisoning of packages such as LiteLLM, with the malware executing inside automated build systems and developer environments to harvest sensitive secrets at scale.
SANDCLOCK is designed to extract high-value authentication material and operational secrets from compromised hosts. Reported targets include AWS credentials, GitHub tokens, Kubernetes ServiceAccount tokens and configurations, SSH keys, local environment variables, environment files, package publishing credentials, cloud credentials, AI service keys, and in some reporting cryptocurrency wallet data. Multiple accounts state that it searched build runners for secrets in files and environment variables, and in some cases scraped process memory to recover in-memory credentials. It has also been reported to target AI and LLM-related keys and gateway settings in affected build paths.
On compromised CI/CD runners, SANDCLOCK reportedly escalated privileges to root before conducting collection. Its exfiltration behavior was built for stealth: it has been described as mimicking legitimate telemetry traffic and disguising outbound data transfer as monitoring-style POST requests to evade network detection. Separate reporting states that stolen data was encrypted prior to exfiltration, and that if direct exfiltration failed, operators could fall back to abusing the victim's source-control environment to upload stolen material. The malware has therefore been characterized as a purpose-built infostealer optimized for ephemeral build infrastructure and software supply-chain access.
SANDCLOCK has been linked to broader criminal monetization beyond initial theft. Stolen credentials obtained through TeamPCP supply-chain operations have been assessed as enabling downstream repository tampering, package poisoning, cloud-account compromise, and follow-on extortion or ransomware activity. Reporting also describes collaboration between TeamPCP and other criminal actors, including cases where credentials sourced through these compromises were later used in downstream exploitation. The malware is primarily associated with Linux-based CI/CD runners and developer build systems, though some reporting also places it in Python package compromise chains affecting developer workstations and automated build environments more broadly.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The group's March campaign exploited mutable GitHub Actions version tags in Aqua Security's Trivy scanner (CVE-2026-33634, CVSS 9.4) to deploy the SANDCLOCK credential stealer across an estimated 10,000-plus CI/CD pipeline runs. | The injected payload was the SANDCLOCK credential stealer, a purpose-built tool that mimics legitimate telemetry traffic — disguising exfiltration as POST requests to domains resembling monitoring services — to evade network detection controls.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is a chained software-supply-chain attack attributed to TeamPCP, delivering the “SANDCLOCK” credential-stealer.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers used stolen credentials to clone more than 300 of Cisco's internal GitHub repositories, exfiltrating source code for Cisco AI Assistant, Cisco AI Defense, and products that had not yet been publicly announced.
Bei einem Lieferkettenangriff auf die populäre LiteLLM-Bibliothek im März dieses Jahres haben Angreifer im Python Packages Index (PyPI) kompromittierte Pakete eingeschleust.
The malicious LiteLLM releases were published after the compromised Trivy component reached the project’s build environment. The incident carries the risk of trusted package supply chain attacks: one altered dependency can reach environments before maintainers react.
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
Execution T1059 Command & Scripting (CI runner) Malicious code runs inside CI/CD job context
...haben Angreifer im Python Packages Index (PyPI) kompromittierte Pakete eingeschleust. Diese wurden offenbar von automatisierten Build-Systemen zigtausendfach heruntergeladen und verwendet...
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
The injected payload was the SANDCLOCK credential stealer, a purpose-built tool that mimics legitimate telemetry traffic — disguising exfiltration as POST requests to domains resembling monitoring services — to evade network detection controls.
File path /proc/<pid>/mem Process memory path reportedly scraped for CI/CD secrets
Attackers used stolen credentials to clone more than 300 of Cisco's internal GitHub repositories, exfiltrating source code for Cisco AI Assistant, Cisco AI Defense, and products that had not yet been publicly announced.
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
SANDCLOCK scraped secrets from CI runner memory and transmitted AWS keys, GitHub tokens, Kubernetes configurations, and SSH private keys to attacker-controlled infrastructure.
On a CI/CD runner, the credential-stealing payload sought elevated access and searched for SSH keys, cloud credentials, Kubernetes tokens, environment files and secrets in process memory.
On a CI/CD runner, the credential-stealing payload sought elevated access and searched for SSH keys, cloud credentials, Kubernetes tokens, environment files and secrets in process memory.
On every compromised runner the stealer escalated to root and swept SSH keys, cloud credentials, Kubernetes tokens, .env files and in-memory secrets from /proc/<pid>/mem
Collection T1114 / T1530 local capture Writes secrets to local 127.0.0.1 capture files
Die Daten haben die Angreifer mit AES-256 und einem fest einprogrammierten RSA-4096-Key verschlüsselt und an Server gesendet, die eine Typosquatting-Domain nutzten.
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential-stealing malware used in the LiteLLM/Trivy supply-chain campaign. It executed inside compromised CI/CD runners, escalated to root, harvested environment secrets, SSH keys, cloud credentials, Kubernetes tokens, .env files, and in-memory secrets from /proc/<pid>/mem, then wrote per-run loot files for exfiltration.
Infostealer malware used in the LiteLLM supply-chain attack. It executed on compromised build systems, escalated privileges to root, searched for secrets including cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and LLM/API provider keys, then exfiltrated the data encrypted to attacker-controlled servers. If exfiltration failed, it created a public GitHub repository in the victim account and uploaded the stolen data there.
Credential-stealing payload delivered via compromised LiteLLM PyPI releases in a supply-chain attack. It executed through a malicious Python .pth startup file, searched CI/CD runners and developer environments for SSH keys, cloud credentials, Kubernetes tokens, repository tokens, LLM API keys, environment files, and secrets in process memory, then exfiltrated the data via encrypted transfer or by creating public GitHub repositories in the victim account.
Credential-stealing payload delivered via malicious LiteLLM PyPI releases in a supply-chain attack. It executed through a malicious Python .pth startup file, searched CI/CD runners and developer environments for SSH keys, cloud credentials, Kubernetes tokens, environment files, secrets in process memory, repository tokens, and AI/LLM service keys, then exfiltrated the data to attacker-controlled infrastructure or, on failure, via a public GitHub repository created in the victim account.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.