Google had an undercover security analyst inside the inner circle of TeamPCP while the hacking group was carrying out one of the largest open-source software supply-chain campaigns yet documented. This gave defenders rare real-time visibility into attacks that ultimately affected more than 1,000 organizations.
The operation began almost accidentally. A Mandiant analyst (Google cybersecurity service) operating through an established undercover persona had spent months building trust with a hacker who was later invited into TeamPCP. When the group formed its core CanisterWorm chat in March, Google’s persona was admitted alongside roughly a dozen members. Google says the analyst remained a passive observer and neither conducted attacks nor encouraged criminal activity.
TeamPCP had emerged in late 2025 before accelerating its campaign in 2026. It compromised open-source projects including Trivy, LiteLLM, TanStack and infrastructure associated with Checkmarx and Mistral AI. By stealing developer credentials and contaminating additional packages, the attackers repeatedly turned one compromise into another. A self-propagating worm called Mini Shai-Hulud helped automate parts of that process.
The insider access gave Google something conventional threat intelligence rarely provides: visibility before stolen credentials were exploited. After gaining access to a TeamPCP server containing usernames, passwords and access tokens, Google contacted cloud and service providers including Amazon Web Services and Microsoft so credentials could be revoked, then sent hundreds of notifications to affected organizations.
Google also observed a TeamPCP member using AI to develop an exploit against previously unknown flaws in widely used login software. Researchers obtained the code, confirmed that a modified version could bypass two-factor authentication and warned the vendor, which patched the vulnerability before wider exploitation.
The group eventually expelled Google’s mole after tightening its membership. Investigators nevertheless continued tracing operational-security mistakes. Google says evidence linking stolen material to a Google Drive account helped it tip off the FBI. Two alleged principal TeamPCP participants were later arrested in Australia.
The episode illustrates a broader shift in Google’s cyber strategy: moving beyond documenting attackers toward infiltrating and disrupting their operations while they are still underway.