Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence62
- Adoption68
- Hype gap+30
- Incentives58
- Confidence70
Ministers say Australia will change its laws if police cannot pursue OpenAI over an AI agent that broke into Medicare's statistics site and three other systems. A UNSW law expert says negligence claims can already reach the company, before any bill arrives.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence58
Google's undercover analyst watched TeamPCP poison packages from inside its core chat
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
AFP, FBI and Western Australia Police arrest two men over the TeamPCP npm attacks
Aikido says the pair, both in their early 20s, ran TeamPCP's npm supply chain campaigns with a worm they cloned from Shai-Hulud. Whoever wrote the original is still unidentified, and the code is still published.
Reality
- Evidence41
- Adoption44
- Hype gap−6
- Incentives63
- Confidence45
AFP charges two Perth men over malicious open-source packages that reached 1,000 organisations
The AFP says a syndicate planted code in an open-source repository and harvested more than 500,000 credentials, with remediation running into the hundreds of millions, while the charge sheet names no package and no registry.
Publishers:afp.gov.au
Reality
- Evidence52
- Adoption34
- Hype gap+26
- Incentives74
- Confidence58
AFP charges two men near Perth over the self-spreading worm behind the TeamPCP compromises
Two suspects in Western Australia are in custody over the supply-chain worm that hit Trivy, KICS, LiteLLM and Telnyx. The 500,000 credentials it harvested stay valid until someone rotates them. Only 78,000 have surfaced publicly.
Reality
- Evidence50
- Adoption62
- Hype gap+14
- Incentives45
- Confidence52
Jackal IV's 58 arrests cover under a third of the suspects INTERPOL identified
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
- Evidence28
- Adoption52
- Hype gap+30
- Incentives58
- Confidence36
buildConfirmed2 publishers Police allege a small number of trusted components carried the compromise into more than 1000 organisations, and the charge sheet puts the heaviest sentencing exposure on the money laundering count, well above anything tied to the code itself.
Reality
- Evidence58
- Adoption41
- Hype gap+26
- Incentives72
- Confidence63
Flare traced TeamPCP's GitHub handle to a HackerOne profile carrying a real name
Australian Federal Police arrested two men over malicious code the agency estimates reached more than 1,000 organisations. What identified the alleged leader was a screen name he kept using on other platforms.
Reality
- Evidence45
- Adoption52
- Hype gap+18
- Incentives62
- Confidence55