If you use an AI coding assistant, it reads a hidden folder in every project you open. A supply chain crew has worked out that almost nobody watches those folders.
That is one of the sharper findings in a quarterly report from Google Threat Intelligence Group on how attackers are actually using AI, drawn from Mandiant incident response work and Google's own platform defenses. The headline shift is from prompting to autonomy: in one Q2 2026 case, GTIG watched an actor compromise a cloud resource and then plan, build and run an agent-driven mass credential harvesting campaign in under six hours. But the most concrete material concerns a financially motivated group GTIG tracks as UNC6780, better known as TeamPCP.
A folder no scanner is watching
TeamPCP's credential stealer, which GTIG calls DUSTMAKER, drops or modifies files inside the hidden workspace directories that AI assistants and editors manage, including .claude, .cursor and .vscode. The point is camouflage. Those directories churn constantly during normal development, and they sit outside the places endpoint detection watches most closely, such as Windows registry run keys or /etc/cron.d. Once the files are there, DUSTMAKER uses them to create automated build or startup commands so the malware runs whenever the editor or the AI extension does.
Getting into a project in the first place is the other half. GTIG says TeamPCP compromised legitimate developer accounts to publish trojanized forks of real Model Context Protocol servers to PyPI, including one named tiktoken_mcp, and injected malicious code straight into official organizational repositories such as azure-functions-mcp-extension. Backdoor the integration and the payload arrives every time somebody clones or installs it. That is the same failure mode as the repository configuration trick that hijacks coding agents on open, arriving through a different door.
Signed, attested, and entirely malicious
The part defenders should sit with is what DUSTMAKER does when it lands in a build pipeline. It detects that it is running in a continuous integration environment, then pulls OpenID Connect tokens out of the memory of GitHub Actions runners. With those tokens it authorizes itself as a trusted publisher and pushes compromised package versions carrying valid, cryptographically signed SLSA Build 3 attestations. Packages published that way, GTIG notes, pass the automated trust checks an AI coding agent performs. The provenance is real. The code is not.
TeamPCP has been running large scale compromises of PyPI, npm and Docker Hub since March 2026, and it monetizes access either by selling stolen data or by handing it to extortion partners. In one Mandiant case the group established access and passed it to a separate actor who issued a ransom demand under LAPSUS branding, after exfiltrating a copy of the victim's proprietary AI repository that a malicious GitHub Actions workflow had been added to. We saw the resale pattern before when the crew's LiteLLM compromise exposed secrets from around 2,500 companies.
Now the AI stack is the prize
GTIG says adversaries with a wide range of motives are now going after AI assets directly: proprietary models, source code, prompts and research across healthcare, government and media, plus API credentials. Some hijack victim cloud environments to run their own high-performance compute workloads, a practice the report calls LLMjacking, and others simply buy compromised AI platform accounts to sidestep access costs. Model weights and compute quota are being treated as targets in their own right.
Audit the dot-folders in your repositories
Treat AI assistant workspace directories as executable content, not configuration noise: put .claude, .cursor and .vscode under source control review and alert on unexpected changes. In CI, scope OIDC tokens as tightly as the workflow allows and watch for processes reading runner memory, because a stolen publishing token defeats attestation checks entirely. Trusted-publisher provenance tells you a package came from a pipeline. It does not tell you who was standing in it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.