Google Put an Undercover Analyst Inside TeamPCP’s Supply-Chain Gang

Opening & At a Glance

TeamPCP’s supply-chain rampage—poisoned open-source packages, stolen developer credentials, a Dune-themed worm—already ranked among 2026’s ugliest software-ecosystem stories. WIRED’s 18 September report added a twist: Google’s Mandiant had an undercover analyst inside the group’s inner chat almost from day one. Austin Larsen of Google Threat Intelligence Group detailed the operation ahead of a LABScon talk.

What Happened, in Plain English

According to Larsen’s account to WIRED, a Mandiant persona spent months building trust with an actor who was later invited into TeamPCP. When that invite landed, Google’s analyst joined CanisterWorm. Visibility extended to a server holding stolen usernames, passwords and tokens. Rather than email every breached company first, Google prioritised providers where those credentials could be replayed—cloud and identity platforms—then followed with victim outreach.

Public reporting ties TeamPCP’s campaign to compromises affecting projects and organisations including Trivy, LiteLLM, TanStack, Checkmarx infrastructure, Mistral AI, GitHub, Mercor, and employee devices at OpenAI and the European Commission, among others. The AFP has described a haul exceeding half a million users’ credentials. A worm branded Mini Shai-Hulud automated parts of the spread. Exact attribution for every listed victim should be read as reporting summary, not a court finding against named individuals until proven.

From Watching to Disrupting

Larsen described a deliberate shift toward disruption inside Google Threat Intelligence, aligned with a Cyber Disruption Unit posture: “Writing reports can only be so useful.” The undercover role, he emphasised, stayed observational—“a fly on the wall”—without participating in or encouraging illegal hacking.

Inside the same circle, Google says someone used an AI tool to develop a previously unknown exploit path that could bypass two-factor authentication on a popular login product. Google obtained the code, validated that minor tweaks made it work, and warned the developer, who shipped a patch. A May case study described the technique without naming TeamPCP at the time.

Partners, Betrayals, and Opsec Failures

WIRED reports TeamPCP struggled to monetise its haul—Larsen estimated tens of thousands of dollars in extortion versus the scale of credentials stolen—and partnered with other criminal groups including ShinyHunters. That partnership collapsed into betrayal: ShinyHunters allegedly ran solo extortions and even shared chat logs with Larsen, unaware Google already had a mole. TeamPCP then tightened the circle, moved servers, and ejected members—including Google’s analyst.

Identification of Thomson, per Larsen, later leaned on conventional digital detective work: forum leaks linking a CanisterWorm handle to a personal Gmail, older PayPal trails, and stolen material backed up to a Google Drive on that same account—prompting a tip to the FBI. Brian Krebs and others also published investigative threads around the same period. Charges are allegations; both men could not be reached for comment in WIRED’s piece.

Why B2B SaaS and Devtool Vendors Should Care

This is not only a “hacker drama” story. It is a reminder that modern SaaS trust sits on npm packages, CI tokens, cloud roles and login products. A worm that turns one compromised maintainer account into many is an existential brand risk for developer platforms. Credential revocation at the identity provider layer bought time that one-by-one victim emails could not.

For founders naming security, identity, or developer-tool companies, crisp brand assets help when you need customers to recognise a trustworthy operator in a noisy breach week. That is the acquisition-aware angle behind watching domains like RogueGhost.com: memorable enough for a cyber or SaaS flagship, flexible enough if the product surface expands.

Questions Readers Are Likely to Ask

Did Google’s mole commit crimes? Larsen says no—observational only, with internal guardrails.

Are Thomson and Gaebler guilty? They face charges described by police as involving principal participation; courts decide guilt. This article treats them as alleged.

Was the 2FA bypass “AI-made”? Reporting describes an AI tool used to develop the exploit; Google still needed humans to obtain, test and disclose it.

Closing & Sources

TeamPCP showed how fast open-source trust can be industrialised against SaaS. Google’s account shows how insider visibility plus provider-level revocation can blunt a campaign—and how sloppy personal opsec still unravels alleged operators. Read every dollar figure and victim list as reported; read every charge as unproven until adjudicated.

• WIRED (Andy Greenberg) — An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang (18 Sep 2026)
• Pivot News summary of Larsen / LABScon remarks (20 Sep 2026)
• AFP / FBI cooperation reporting around late-August arrests; Google Threat Intelligence public comments

Methodology Note: Editorial summary of WIRED and corroborating secondary reports. Allegations against named individuals are not proven guilt. RogueGhost is not affiliated with Google, Mandiant, or law enforcement. For corrections, contact site administrators.