Case gtig-dustmaker-ci-promptsAI supply chainWorldwide
TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners
UNC6780's DUSTMAKER steals GitHub Actions OIDC tokens to publish poisoned packages with valid SLSA attestations, persists via AI-assistant config folders and embeds adversarial prompts so LLM scanners ignore it.
CriticalAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 8, 2026
- Location
- Worldwide
- Target
- Open-source maintainers on PyPI, npm and Docker Hub
- Severity
- Critical
- Triggered by
- TeamPCP / UNC6780 / Altered Spider
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
UNC6780's DUSTMAKER steals GitHub Actions OIDC tokens to publish poisoned packages with valid SLSA attestations, persists via AI-assistant config folders and embeds adversarial prompts so LLM scanners ignore it.
Impact: Compromised packages across major registries; more than 23,800 secrets including AI API keys seen on a related C2 dashboard.
Who triggered it
Actor: TeamPCP / UNC6780 / Altered Spider
Attribution: GTIG attributes DUSTMAKER and SANDCLOCK to UNC6780, active since at least March 2026.
Motive: Credential theft resold to ransomware and extortion partners
How it happened
Attack vector: Trojanized MCP server forks, malicious pull requests, CI/CD abuse disguised as Copilot Setup, prompt injection in AGENTS.md and loader comments
Root cause: AI workspace files are trusted and executed by agents and IDEs; LLM-based scanners can be talked out of flagging code
Timeline
- TeamPCP supply-chain campaign begins with PyPI packages and SANDCLOCK stealer
- GTIG documents DUSTMAKER and an exposed Recon dashboard holding 23,800+ harvested secrets
Response
Google disabled abusive assets, strengthened classifiers and published indicators; Mandiant handled related incidents.
Current status: Ongoing
Sources (open in a new tab)
- GTIG From Prompting to Autonomy cloud.google.com
- CSA research note labs.cloudsecurityalliance.org
- Hendry Adrian mirror hendryadrian.com
Cite this case
TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners. AI Threat Watch, case gtig-dustmaker-ci-prompts, Sep 8, 2026. https://aithreat.io/cases/gtig-dustmaker-ci-prompts/
Permanent link: https://aithreat.io/cases/gtig-dustmaker-ci-prompts/