Google’s Hacker Mole Shows the New Front Line of Cybercrime

• A Mandiant analyst entered TeamPCP’s private inner circle in March 2026, giving Google visibility into the group’s attacks and stolen credentials.¹
• Google says it used that access to warn cloud providers, revoke credentials and block attempts to exploit victims before the hackers could use them.¹
• TeamPCP targeted PyPI, npm and Docker Hub, using compromised packages to steal developer credentials and move from AI software into wider corporate networks.²
• US prosecutors have charged Australian man Ruben Ian Thomson over alleged TeamPCP attacks; the indictment says poisoned tools were used to steal data and extort downstream customers.³
• The public record still does not establish the full number of victims, which attacks Google stopped or whether every incident attributed to TeamPCP came from the same operators.

Google’s operation reveals a striking shift in cyber defence: a private security company was not merely observing criminals or writing a report after the damage. It placed a covert persona inside the group, watched its plans and then intervened by asking providers including Amazon Web Services and Microsoft to invalidate stolen credentials. Google says it sent hundreds of warnings, prioritising the companies that controlled access to the compromised accounts.¹

That intervention mattered because TeamPCP’s method turned ordinary developer tools into launchpads. The group poisoned open-source packages, harvested secrets and used those secrets to compromise more software, including tools used in artificial-intelligence development. Google says the attackers also hid instructions in project files to manipulate AI coding assistants and used malicious workflows to steal tokens from software pipelines.²

The danger is not only that one gang reached many companies. It is that the software ecosystem gives attackers repeated chances to expand: one stolen developer account can publish a tainted package; that package can reach another developer; the second compromise can expose more credentials. US prosecutors say the resulting code was designed to search downstream systems, exfiltrate sensitive data and preserve access for later extortion.³

Google’s account should nevertheless be treated as an intelligence assessment, not a court finding. Thomson has been indicted, not convicted, and the indictment identifies alleged conduct rather than proving it. Google has also not publicly named the undercover analyst or provided a complete accounting of the victims it says were protected. That leaves an important question unanswered: how much of the campaign was actually stopped, and how much had already spread before the intervention began?

Footnotes

1. WIRED, “An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang”, 18 September 2026 ↩ ↩² ↩³

2. Google Threat Intelligence Group, “GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI”, 8 September 2026 ↩ ↩²

3. US Attorney’s Office for the Northern District of California, “Australian Man Indicted For ‘TeamPCP’ Cyberattacks On Software Supply Chain”, 27 August 2026 ↩ ↩²