Google reveals undercover Mandiant analyst infiltrated hacking group that breached 1,000+ firms
cyb3rops · x · 2026-09-19
Google disclosed that an undercover Mandiant analyst penetrated the inner circle of hacking group TeamPCP, whose supply-chain compromise of open-source software breached more than 1,000 companies.
Key details:
- The analyst joined the 12-member core "CanisterWorm" chat in March and monitored operations from the inside;
- The mole also accessed a server holding stolen credentials — usernames, passwords, and access tokens;
- Google used that visibility to alert cloud and tech providers, revoke compromised credentials, and send hundreds of notifications to affected organizations;
- The operation also exposed a member developing an AI-assisted zero-day capable of bypassing two-factor authentication in widely used login systems.
More from Safety
- North Korea stole $6.3B from Binance via fake job interview that compromised engineers — aakashgupta · 2026-11-04
- OffsecCyber dataset combines HackerOne reports and CVEs to train pentesting LLMs — AccBalanced · 2026-11-04
- Abliterated GLM-5.3 pulls off red-team exploit in 3:41 for $0.02, stock model refuses — bratton · 2026-11-04
- AI industry bet on both parties: $55M+ spent this election cycle via dual PACs — ChrisGPT · 2026-11-04
- Valid tokens, allowed actions, zero intent checks: the agent security gap nobody solves — Cytersmyz · 2026-11-04
- Princeton paper: harsher penalties can make AI auditors inspect less — Few-Decision6287 · 2026-11-04