The Steam avatar that unmasked TeamPCP: what the AFP arrests teach you about identity hygiene

TL;DR - Yesterday the Australian Federal Police arrested two men in Western Australia, aged 21 and 23, over their alleged roles in TeamPCP, the crew behind the longest-running software supply-chain attack spree on record. The attribution chain that unmasked one operator ran through a single cat avatar reused across HackerOne, Hugging Face, TikTok, Steam and Telegram for about a decade. What you need to do: pin your GitHub Actions to full commit SHAs, treat credential rotation as an inventory exercise, scope publishing tokens narrowly, alert on outbound traffic from your security tooling, and monitor your own domains in stealer logs.

By the numbers

I wrote about the LiteLLM poisoning back in August, when I spent a morning auditing my own home gateway to check whether the 40-minute poisoned-publish window had touched my stack. The crew behind that attack had a name: TeamPCP. Yesterday morning the AFP announced they'd arrested two alleged members of it, in Western Australia, about as far from the usual cybercrime geography as you can get.

Then I watched John Hammond walk through Flare's deanonymization of one of the operators, and I put my coffee down.

The arrests are good news on their own. But the part I can't stop thinking about is how they got there. No zero-day. No informant. No seized server with a spreadsheet of real names. The thread that unravelled the longest-running supply-chain spree on record was a profile picture. A cat. Uploaded to Steam and left there for ten years, while its owner went on to poison build pipelines used by thousands of organisations.

Let me walk you through what TeamPCP actually did, how a cat picture became an arrest warrant, and the five controls Flare's write-up hands you at the end.

What TeamPCP actually did

TeamPCP started in late 2025 as an opportunistic cloud-exploitation crew. They ran an automated scanner across the internet looking for exposed APIs: Docker APIs, Kubernetes control planes, Ray dashboards, Redis instances, anything left open. Compromised hosts became botnet nodes, scanners and proxies. Revenue came from crypto miners, proxy rental and extortion. Flare's honeypots fingerprinted 185 Docker compromises in a single campaign, and their React2Shell campaign against Next.js applications had a control-server dashboard showing almost 60,000 compromised servers in under 48 hours.

In early 2026 they pivoted to the software supply chain, and that's where they earned the headline.

In February they exploited a misconfigured GitHub Actions workflow in Aqua Security's Trivy, one of the most widely deployed open-source vulnerability scanners in the world, and stole a service-account token. Aqua rotated credentials after the intrusion. They missed some. TeamPCP kept access.

In March they published a malicious Trivy release across every distribution channel at once, poisoning thousands of CI/CD pipelines with credential-stealing malware. LiteLLM, an AI proxy library pulling roughly 95 million downloads a month, ran the poisoned Trivy inside its own build pipeline. The attackers harvested LiteLLM's PyPI publishing token and shipped two backdoored releases. One stolen token, five ecosystems, about five days.

CloudSEK's analysis, cited by Brian Krebs, puts the harvest at cloud service keys and other secrets from more than 2,500 organisations, including many of the world's top tech companies. They also hit TanStack, Checkmarx, Telnyx and ran the Shai-Hulud worm campaigns. Krebs describes it as the longest-running spree of software supply-chain attacks ever recorded.

And they were loud about it. Telegram channels, a Twitter account, taunting victims, a press interview with Forbes where a spokesperson described the group as "a loose-knit group of teenagers and young adults who couldn't find paying work, so they turned to cybercrime." That appetite for credit is what killed them.

The cat picture that changed how I think about identity hygiene

Flare's Emerging Threats Team anchored the whole investigation on one alias: DeadCatx3, a GitHub account hosting TeamPCP tooling. From there the chain ran like this:

• DeadCatx3 → HackerOne. A username-pivot search turned up a HackerOne account under the same handle, with a real name on the profile: Ruben Thomson.
• HackerOne → Hugging Face. A Hugging Face account used the initials "RT" and referenced a domain, masscan[.]cloud, that Flare had already fingerprinted as command-and-control infrastructure for the mini Shai-Hulud worm in May. The personal profile was pointing at the crime scene.
• Name → school email → leaked password. The name led to a school email address, and the school email led, via credential breaches and stealer logs, to passwords and a second address: surfinup8@gmail.com. The investigators turned the attackers' own weapon (infostealer logs) back on them.
• Gmail → TikTok. Accounts tied to that Gmail included a TikTok profile, yolosolo17, again under the name Ruben Thomson. It had exactly one video: a screen recording of a Steam account called YolocrownZ, based in Perth, with one VAC ban on record dated 13 September 2016.
• Steam → Telegram. The Steam profile picture was a distinctive cat. When Flare searched Telegram chatter for TeamPCP's @pcp.sh handle, the account that popped up was using the same cat avatar.

Hammond's summary of that moment is the best line in his whole video:

"That same person who wanted all this attention and spotlight for the memes, for the lols, or the kitty cat profile picture, turns out there was another unique kitty cat profile picture that they left on a Steam profile for a decade just waiting for someone to find it."

Flare passed the attribution to law enforcement. The AFP arrests followed.

I keep coming back to the asymmetry of it. TeamPCP's technical OPSEC was decent enough to run a year-long campaign against some of the best-defended software infrastructure on earth. Their identity OPSEC was a teenager's Steam account. Every control they bypassed in other people's pipelines was harder than the control they failed to apply to themselves: never reuse anything across your personas. One image, one handle, one email, that's all a patient investigator needs, because OSINT pivots compound. Each link in that chain is unremarkable on its own. The chain itself is a name and a suburb.

Two names, one crew

One nuance worth stating plainly, because the coverage will blur it. Flare's chain unmasks the DeadCatx3 operator as Ruben Thomson. Krebs's reporting names a different handle, @pcpcats (also Express, BulkDMT, EllisD25), as the group's public spokesperson, and Krebs's own forensic trail runs through passive-DNS records tying a Perth IP address to the Thomson family across 2022 to 2025. Two investigators, two overlapping but distinct chains.

Google Threat Intelligence Group's Austin Larsen gave Krebs the frame that reconciles it: TeamPCP "is not a structured criminal crew with a single operator. It is a peer community" of individually skilled actors, with George Prepakis (@kernelstub, who ran the Matrix "Cybercats" chat server) as the centre of gravity. Two men are in custody. Others in the orbit are presumably reading the same articles you are.

For defenders the nuance doesn't change the lesson. Both operators fell to the same failure mode: reused artefacts across identities. Avatars, emails, passwords, IP ranges. The attacker's graph and your exposure graph are built from the same stuff.

The five controls worth your Monday morning

Flare ended their write-up with five takeaways, and they're the reason I wanted this on the blog rather than left as a news story. These are load-bearing, so I'm quoting them directly:

1. Pin GitHub Actions to full commit SHAs, not tags. "Tag references resolve to whatever the maintainer's repository points at, which is exactly what TeamPCP replaced." If your workflow says uses: some-action@v3, you are trusting the maintainer's tag to stay put. After March, that trust is a bet you should stop making.
2. Treat credential rotation as an inventory exercise, not an incident task. "Aqua rotated after the February intrusion and still left the access that shipped a backdoored release three weeks later. Rotation only works if you know the full set." Aqua Security is a security company, and they still missed a token. The question for your org: could you enumerate every credential a given system holds, right now, without asking anyone?
3. Scope publishing tokens narrowly and give them short lifetimes. "A PyPI token that can publish anything, forever, converts one build-pipeline compromise into a supply chain event." A token that expires in hours and can only publish one package turns the LiteLLM scenario into a much smaller problem.
4. Alert on outbound connections from security tooling. "A vulnerability scanner making unexpected network calls during a build is a high-signal, low-noise detection, and it is what the Trivy and LiteLLM payloads both required." Your scanner has a known-good egress profile. Anything outside it deserves a page.
5. Monitor your own domains in stealer logs and combolists. "The same reused-credential exposure that let us walk from a school email to a Telegram avatar is what an attacker uses to walk into your environment." The investigators' path to Thomson is, step for step, the path an attacker takes into a corporate network.

What to do this week

None of this is exciting. But it works. My suggested order:

1. Grep your workflows for tag-pinned actions (uses: .*@v) and pin them to SHAs. An afternoon, worst case a day.
2. Pull the credential inventory for your build systems. Every token, where it lives, what it can do, when it expires. The gaps you find are the story.
3. Shorten publishing-token lifetimes on PyPI, npm and anywhere else you ship from. Scoped, single-package, short-lived.
4. Write one detection rule: egress from build agents or security tooling to anything outside your allowlist. TeamPCP's payloads needed the network. Make the network expensive for them.
5. Check whether your corporate domains appear in stealer logs. Several threat-intel vendors offer this as a service; some will do a one-off check free. The crew that ran Trivy got caught by exactly this data source, used in reverse.

My take

There's a temptation to file this under "kids get caught, justice served" and move on. I'd resist it. The supply-chain playbook TeamPCP ran (steal a CI token, ride trusted tooling, inherit every downstream consumer) is now public, proven, and cheap. Copycats don't need TeamPCP's patience, because the write-ups include the parts list. The arrests remove two actors. They don't remove the technique.

The defender side of this story is good news, though. The same hygiene failures that let investigators walk a cat picture to a front door in Perth are the failures that let attackers walk a leaked password into your build pipeline. Identity hygiene and credential hygiene are one discipline wearing two hats, and this week gave you a very concrete story to take to whoever signs off on token-scoping work.

The most memorable security control of 2026 might turn out to be a ten-year-old Steam avatar. There's a sentence I didn't expect to write.

Mathew Clark Founder, SecureInSeconds Currently: thinking the most underrated security control is a unique Steam avatar per persona.

Further reading

• Flare: TeamPCP and the software supply-chain attacks - the first-party forensic walkthrough, including the full DeadCatx3-to-Thomson chain and the five defender takeaways
• Krebs on Security: Two alleged TeamPCP hackers arrested in Australia - the independent third-party account, with the AFP statement and the @pcpcats attribution
• Forbes (Thomas Brewster): Hackers launch devastating attacks on AI devs - the March interview with a TeamPCP spokesperson
• Wired (Andy Greenberg) - corroborating coverage cited within the Krebs piece
• John Hammond: DOXXED by his CAT PROFILE PICTURE - the full Flare-platform recreation of the investigation, 17 minutes well spent
• AFP media releases - the arrest statement
• My own LiteLLM audit from the March poisoning - what the attack looked like from a home gateway's Postgres logs
• The rust-arrayref supply-chain attack - same playbook, different ecosystem, from last week
• AI offense is automated. Defence isn't. - the editorial frame this story sits inside