Australia arrests two TeamPCP suspects over attacks on OpenAI, Mercor, and open source projects

The Australian Federal Police arrested two men in Perth accused of belonging to TeamPCP, a cybercriminal group blamed for a series of breaches against major technology companies in recent months. According to a TechCrunch report, the two face more than a dozen charges including computer intrusion, money laundering, and other cybercrimes, and were expected to appear in court on Thursday.

The case matters for developers in Brazil because the targets aren't obscure: they are tools and platforms that sit in the pipeline of development and AI teams around the world, including here.

What the group was doing

According to the Australian authorities, the accused promoted breaches and tampering with popular open source projects. The core tactic was an attack on the software supply chain: the hackers compromised an open-source tool potentially used by thousands of companies and injected malicious code into it.

Once installed on a company's or developer's systems, the code stole private keys and other sensitive credentials used to access cloud storage and, often, customer data. Authorities say the group amassed more than 500,000 credentials to escalate attacks against other companies.

The FBI's head of cyber, Brett Leatherman, was quoted saying the two alleged TeamPCP members are accused of breaching more than a thousand organizations.

Targets: Trivy, LiteLLM, Mercor, OpenAI, and GitHub

Among the victims is a tool widely adopted by DevSecOps teams: Trivy, an open-source vulnerability scanner. The compromise of Trivy affected, by extension, any company that relied on it, including the LiteLLM platform and AI recruiting startup Mercor.

The group is also suspected of:

• breaching the European Commission's cloud infrastructure;
• targeting other open source projects and developer apps that granted access to giants like GitHub and OpenAI.

The logic is telling: instead of attacking OpenAI or GitHub directly, TeamPCP went after the weakest link, a dependency or developer tool with access to those platforms. It's the same pattern seen in recent supply chain attacks that shook ecosystems like npm's.

How investigators reached the suspects

The Australian investigation began in April 2026, after tips from several cybersecurity firms. Police did not release the names of those arrested, but independent journalist Brian Krebs exclusively reported that one of them is Ruben Thomson, known by the hacker alias Ellis.

Krebs says he had been in contact with Ellis in the preceding months. The hacker reportedly told the journalist that he led TeamPCP until March 2026 and made mistakes that allowed the reporter to uncover his real identity.

It's still unclear whether the US Department of Justice will seek extradition, and an FBI spokesperson did not immediately comment to TechCrunch. At a press conference on Wednesday, Australian authorities said they had seized a large amount of allegedly stolen data, along with devices and other electronic equipment, and said they intend to notify the victims.

What changes for developers in Brazil

The practical point isn't the arrest itself, but the attack vector. Brazilian teams that use Trivy in CI pipelines, integrations via LiteLLM, GitHub tokens, or OpenAI API keys operate on exactly the surface this group exploited. A compromised security scanner is the most ironic scenario possible: the tool meant to protect becomes the entry point.

Some concrete actions this case reinforces:

• Treat credentials as perishable. If a dependency has been compromised, rotating private keys, access tokens, and cloud credentials needs to be fast and automatable.
• Prefer short-lived credentials and minimally scoped tokens over long-term keys scattered across environment variables.
• Pin versions and verify integrity of dependencies (lockfiles, hashes, signatures) instead of always pulling the latest tag.
• Monitor post-install behavior of developer tools: supply chain code usually acts during installation or build, exfiltrating secrets.

The case still has loose ends, such as a possible extradition and the full scope of victims, which will only be known as Australia carries out its notifications. But the message for anyone maintaining a pipeline is immediate: trusting a popular open-source tool doesn't excuse skipping credential hygiene around it.