eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
TeamPCP Supply Chain Attacks
Bottom Line: Over the last week, several supply chain attacks were conducted by a group known as TeamPCP, involving the deployment of a credential stealer malware. To date, dozens of projects have been compromised, and similar activity is expected to continue in the near-term.
In March 2026, TeamPCP (aka PCPcat, ShellForce, DeadCatx3), a financially motivated cybercriminal group, compromised several open-source projects including security tools like Trivy vulnerability scanner and Keeping Infrastructure as Code Secure (KICS) analyzer. The group published malicious versions of these projects embedded with custom information stealer malware, conducting massive opportunistic supply chain attacks.
On March 19th, a malicious version of Aqua Security's Trivy vulnerability scanner was published by TeamPCP, that deployed an information stealer capable of exfiltrating CI/CD secrets and creating persistence on the developer system. The threat actors targeted Trivy-related GitHub Actions, by publishing malicious Actions containing a tool named “TeamPCP Cloud stealer”. The stealer harvested SSH, cloud, and Kubernetes secrets and exfiltrated them to a remote server. The attackers published additional malicious versions of Trivy on Docker Hub and compromised one of the Aqua Security’s GitHub Organizations by renaming 44 internal repositories. Aqua confirmed that the malicious versions had been removed.
Leveraging the credentials exposed in the Trivy incident, TeamPCP compromised 141 npm packages, as of the time of writing, by deploying a self-propagating worm, named CanisterWorm capable of creating a backdoor. A variant of the worm with added wiper functionality was identified, which checks the system’s time zone and locale to detect systems located in Iran, wiping all Kubernetes clusters.
On March 23rd, 2026, TeamPCP compromised Checkmarx’s KICS-related two GitHub Actions workflows and two plugins distributed via the OpenVSX marketplace. The attack used the GitHub Personal Access Tokens (PATs) and secrets exposed during Trivy incident. Using similar tactics, TeamPCP further compromised LiteLLM, an open-source Python library and proxy server by publishing two malicious versions to GitHub. Following this, malicious versions of Telnyx Python library used in Telnyx communications platform were identified. All the malicious versions included similar information stealer payload observed in Trivy incident. Malicious versions of KICS, LiteLLM, and Telnyx have been deleted.
eSentire Threat Intelligence Analysis:
TeamPCP specializes in conducting cloud-native attacks, targeting misconfigured Docker APIs, Kubernetes clusters, and CI/CD pipelines. The recent incidents compromising open-source tools and the use of wiper malware, underscore’s the group’s capability of executing large-scale, destructive supply chain attacks. While TeamPCP’s campaign appears largely opportunistic and financially motivated, targeting developers across organizations worldwide, the use of wiper malware against Iranian systems suggests a potential geopolitical dimension to the threat actor’s operations. The campaign follows the threat model demonstrated in the Shai Hulud campaign, by using self-propagating CannisterWorm. eSentire's Threat Intelligence team assesses with high confidence that threat actors will continue to employ and evolve this tactic in the future.
TeamPCP’s financial motivations are further supported by their recent collaboration with the ransomware group Vect. This coalition aims to deploy ransomware across all affected organizations by TeamPCP’s supply chain attacks. Vect is an emerging Ransomware-as-a-Service (RaaS) operation, providing competitive starting affiliate share of 80% compared to other RaaS offerings. TeamPCP is also believed to have partnered with LAPSUS$ extortion group.
The initial Trivy compromise was traced back to an earlier incident, involving an autonomous bot known as “hackerbot-claw.” Although Aqua Security addressed the issue, it was not fully remediated and was subsequently exploited by TeamPCP. The attacks had a cascading effect, as the compromise of one component exposed credentials used to target additional systems, broadening the scope of the supply chain compromise. Due to the criticality of the incident, CVE-2026-33634 (CVSS: 9.4) was assigned to the flaw in the Trivy scanner on March 23rd, and it was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on March 26th.
Organizations should adopt a zero-trust approach to third-party dependencies and CI/CD components by using verified and pinned versions, validating integrity through signatures, and limiting use to trusted sources. Pipelines should enforce least-privilege access with short-lived credentials and isolated environments, alongside continuous monitoring for anomalies. Organizations using the affected tools are advised to ensure they are running secure, up-to-date versions and rotate all related credentials and tokens irrespective of malicious versions being deployed. Implementing robust Endpoint Detection and Response (EDR) solutions can detect and contain threats such as ransomware. The eSentire’s Threat Response Unit (TRU) has conducted threat hunts associated with TeamPCP activity across all customers. As this is an ongoing topic, the eSentire’s Threat Intelligence team is tracking it continuously.
Threat Actors Abuse Railway Infrastructure in Microsoft 365 Token Attacks
Bottom Line: Security researchers have identified a new Phishing-as-a-Service Kit dubbed EvilTokens, that has impacted organizations in the U.S., Canada, Australia, New Zealand, and Germany. eSentire's Threat Response Unit has observed related activity.
On March 23rd, 2026, Huntress released a report on an ongoing identity compromise campaign targeting Microsoft 365 environments through the abuse of OAuth device code authentication. The campaign leverages Railway.com, a legitimate Platform-as-a-Service (PaaS) provider, as backend infrastructure for harvesting and replaying Microsoft 365 authentication tokens at scale. The campaign has impacted more than 340 organizations across multiple countries and business sectors. Huntress in collaboration with Flare.io, attributed the activity to EvilTokens, a Phishing-as-a-Service (PhaaS) platform.
The earliest observed public advertising for EvilTokens occurred on February 16th, 2026, via Telegram channels. Telemetry shared by Huntress indicates that the first confirmed compromises leveraging Railway infrastructure occurred on February 19th and February 24th, 2026. The campaign escalated sharply on March 2nd, 2026, when dozens of organizations began experiencing anomalous authentication events simultaneously. EvilTokens provides multiple products to its customers, featuring capabilities such as AI workflows for bypassing email filters, customizing phishing lures, locating sensitive emails for fraud, custom branding (e.g., Microsoft, DocuSign), integrated Cloudflare Workers for credential capture, and 24/7 customer support with feedback channels.
The EvilTokens technique centers on the abuse of Microsoft’s OAuth device code authentication flow. In a typical device code authentication workflow, a user visits a Microsoft login page, enters a short alphanumeric code, and authorizes access to an application. In this campaign, threat actors generate the device codes themselves and trick victims into entering those codes as part of a phishing lure. Once the victim completes the authentication process, the attacker immediately receives valid OAuth access and refresh tokens. These tokens grant persistent access to Microsoft 365 resources and remain valid even after the victim resets their password.
The threat actors did not directly attack or bypass email security products. Instead, they abused existing URL rewriting services operated by major email security vendors such as Cisco, Trend Micro, Mimecast, and Microsoft. Malicious links were wrapped inside trusted vendor redirect URLs, making the visible hyperlinks appear benign and allowing the messages to pass through multiple layers of email filtering.
The final-stage phishing pages often displayed convincing SharePoint- or Microsoft-themed interfaces and instructed victims to access documents, bid proposals, or voicemail messages. Many of the device code phishing pages dynamically rendered the device code directly on the page, eliminating the need for the attacker to manually distribute codes to victims. Victims were prompted to click a button labeled “Continue to Microsoft,” which opened a genuine Microsoft authentication window. In other scenarios, the victims were clicking through two or three layers to get to the final stage of the attack.
The eSentire Threat Intelligence team has observed EvilTokens‑related activity impacting customers across multiple sectors, including government, construction organizations, healthcare providers, law firms, and legal services. These observations align with findings reported by Huntress. The diversity of victim profiles suggests that the campaign was opportunistic rather than targeted, with lure themes selected based on likelihood of engagement.
eSentire Threat Intelligence Analysis:
The PhaaS model has been increasingly utilized in the modern threat landscape. Its significance lies in its ability to package advanced phishing toolkits, backend infrastructure, and operational support into subscription‑based services that are easily accessible to a wide range of threat actors. This model enables even low-skilled threat actors to execute phishing campaigns that were previously limited to highly capable adversaries. A key takeaway from these incidents is that threat actors no longer require technical expertise to conduct advanced attacks. Instead, they can rely on PhaaS providers to handle the underlying complexity. As a result, the eSentire Threat Intelligence team assesses that the use of such services by threat actors is highly likely to continue increasing in the near term.
According to advertisements observed within Telegram channels operated by the operators, the EvilTokens PhaaS kits are priced between $600 and $1,500 per month. This service provides extensive functionality designed to compromise victim accounts effectively. At this price point, an aspiring cybercriminal gains access to a platform capable of compromising enterprise identities and initiating exploitation within minutes of credential theft. Threat actors no longer need in-depth knowledge of session token interception or authentication bypass techniques. Instead, they can simply subscribe to a service that reduces this complexity and provides ready-to-use tooling for account compromise.
To counter such threats, security teams should adopt a defense‑in‑depth approach to identity security. Organizations are advised to integrate ASN-based and IP reputation data into authentication monitoring processes, flag access attempts originating from anonymization services (e.g. VPN and Proxy), and maintain 24/7 monitoring and response capabilities. Given that the time between credential theft and active exploitation can be short, detection without rapid response is effectively insufficient.
eSentire’s Threat Response Unit (TRU) has previously tracked multiple PhaaS kits, including sustained activity associated with the Tycoon 2FA platform. The TRU team has published technical reports and an advisory detailing the infrastructure, tooling, and tradecraft leveraged by these services. On March 4, 2026, Microsoft, in collaboration with industry partners including eSentire, announced a coordinated disruption operation targeting the Tycoon 2FA PhaaS platform, which had been a significant enabler of Adversary‑in‑the‑Middle (AiTM) phishing campaigns since 2023. In addition, eSentire maintains detection rules designed to identify similar PhaaS kits, enabling earlier detection of AiTM phishing activity. Indicators of Compromise (IoCs) related to EvilTokens are available through the eSentire Threat Intelligence Feed.
Cyber-Espionage Campaign Targeting Telecommunications Organizations
Bottom Line: Activity associated with Red Menshen, a Chinese APT group, has been identified in telecommunications networks, with the goal of enabling espionage operations.
On March 26th, 2026, Rapid7 Labs published a report detailing a cyber-espionage campaign, which they attributed to the Chinese APT Red Menshen. The identified campaign involves targeting telecommunications networks, with the threat actors’ objectives appearing to be “long-term positioning by embedding stealthy access mechanisms deep inside telecom and critical environments and maintaining them for extended periods”. The campaign centers around the deployment of BPFDoor, a Linux-based backdoor that is designed to function within the operating system kernel of impacted systems.
Initial access into target environments was identified to be through the exploitation of Internet-facing applications and devices, and through the abuse of valid accounts. Rapid7 highlights that devices commonly targeted include Ivanti Connect Secure VPN appliances, Cisco IOS and JunOS network devices, Fortinet firewalls, and Palo Alto appliances. Once access was obtained, attackers deployed tools such as the Command-and-Control (C2) frameworks CrossC2 and Sliver, the open-source backdoor TinyShell, and custom keylogger and brute forcing tools. Rapid7 notes that the final payload, BPFDoor, does not expose listening ports or maintain visible C2 channels, but it abuses the Berkely Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel. BPFDoor creates a custom filter, and inspects incoming traffic, activating only when it receives the “magic packet”. Once activated, BPFDoor spawns a reverse shell, granting backdoor access to compromised Linux systems, in what are referred to as “dormant footholds positioned well in advance of operational use”.
eSentire Threat Intelligence Analysis:
Telecom organizations are considered to be primary targets of state-sponsored espionage attacks, given the “vital role” that they play in supporting communications and critical infrastructure. Rapid7 highlights that the consequences of a telecom network being compromised “extend far beyond a single provider or region”, as they do not just impact one company but potentially the “communications of entire populations”. The result is long-term intelligence collection and monitoring of sensitive communications involving “high-value geopolitical targets”, which is why they are attractive targets for espionage-motivated campaigns.
APT groups from various countries have been known to target telecom organizations as part of their cyber operations. Examples include the Russian group Sandworm deploying wiper malware against a Ukrainian telecom company to cause disruptions, and the Iranian APT Subtle Snail targeting satellite communications for data theft. Specifically with Chinese APTs, there is a history of these groups targeting the telecom sector to conduct attacks, with a recent example being Salt Typhoon. Prior to the United States’ presidential election in November 2024, the group compromised several United States-based telecom providers, resulting in the attackers accessing “phone calls, text messages, and communications metadata” of American citizens, including prominent political figures. The campaign also allowed the attackers access to the “systems that federal agencies use to conduct wiretapping operations”, potentially enabling further collection of sensitive data.
Given the critical severity of these attacks and the potential global impacts that they can have, targeted organizations should ensure that a robust patch management policy is in place, which can help identify critical vulnerabilities within edge devices to ensure that relevant security patches can be applied. Security best practice guides should also be followed, which can be used to ensure that devices are properly configured. Organizations should also ensure that Multi-Factor Authentication (MFA) and Conditional Access policies are in place where possible, to protect against brute force attacks and limit the impact of compromised credentials. eSentire's Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
