AFP and FBI Charge Two Australians Over TeamPCP and the Shai-Hulud Supply-Chain Attacks
Australia's AFP, the FBI and WA Police have charged two Western Australia men with 14 offences over their alleged roles in TeamPCP, the cybercrime group tied to the Shai-Hulud worm that authorities say compromised more than 1,000 organizations, including Mercor and OpenAI.
Australian and US law enforcement have arrested two Western Australia men over their alleged roles in TeamPCP, the cybercrime group tied to the Shai-Hulud worm that authorities say compromised more than 1,000 organizations worldwide, including the AI recruitment firm Mercor and OpenAI. The Australian Federal Police (AFP), working alongside the FBI and the Western Australia Police Force (WAPF), charged a 21-year-old man from Cottesloe and a 23-year-old man from Mandurah with a combined 14 offences on August 26, after executing search warrants across three Perth suburbs. For the open-source software ecosystem the group allegedly abused, the arrests read less as a closing chapter than as a prompt to verify dependency hygiene now.
What Law Enforcement Announced
The AFP said it charged the two men on August 26 after a joint investigation with WAPF that ran in parallel with the FBI, describing the pair as alleged principal members of a "sophisticated cybercrime syndicate" that built malicious open-source software to steal data and extort businesses. According to the AFP, officers executed search warrants in the Perth suburbs of Cottesloe, Hamilton Hill and Mandurah, seizing electronic devices and other items.
The 21-year-old from Cottesloe faces eight charges, the heavier of the two sets. They include possessing and supplying data with intent to commit a computer offence, unauthorised modification of data, dealing with proceeds of crime worth $100,000 or more, and failing to comply with an order to hand over a device passcode, ABC News reported. The 23-year-old from Mandurah faces six charges covering similar data offences. Together the two sets add up to the 14 charges the AFP announced.
AFP Commander Graeme Marshall framed the case as cross-border police work, saying cybercrime "knows no borders and is a growing threat globally." The AFP did not name the two men in its public statement, which is standard practice in Australian matters that have not reached conviction. Several Australian outlets have since identified the pair, but The CyberSignal is withholding their names while the charges remain untested in court.
The Scale: 1,000+ Organizations, Mercor and OpenAI
The figure that anchors this case is 1,000. Investigators estimate the malicious code linked to TeamPCP potentially compromised more than 1,000 organizations around the world, enabling the theft of over 500,000 credentials and at least 300GB of data, CyberScoop reported. Among the named victims are Mercor, an AI recruitment company, and OpenAI, whose data was caught up in the campaign, according to TechCrunch.
The group is best known for Shai-Hulud, a self-propagating worm that spread through open-source software packages. Both Ars Technica and The Register tie the two arrested men to that campaign, which reporting has connected to compromises of widely used developer tooling before the theft reached companies like Mercor and OpenAI. The through-line is that a single poisoned package upstream can cascade into hundreds of downstream organizations that never chose to trust the attacker directly.
The FBI put the scope in blunt terms. "These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide," FBI Assistant Director Leatherman said in the joint announcement. The volume of stolen credentials matters as much as the organization count: half a million working logins is the kind of raw material that fuels follow-on account takeovers long after the original packages are pulled.
Why the Arrests Matter for Open-Source Consumers
An arrest does not un-publish a malicious package or roll back a stolen token, so any team that pulls open-source dependencies should treat this news as a cue to tighten controls rather than a sign the risk has passed. The exposure in a campaign like this one sits downstream, in the thousands of builds that already fetched a compromised release, and it does not resolve itself when the people behind it are charged.
Supply-chain compromise has become one of the fastest-growing categories of cyberattack precisely because it turns trust in shared code into a delivery mechanism. The defensive answer is not exotic. It is dependency hygiene applied consistently: pin and lock what you install, slow down before adopting brand-new versions, keep tight control of the tokens your pipelines hold, and watch for the indicators defenders have already published. The checklist below is the short version of what a team consuming open-source packages should confirm this week.
● Defender Checklist Four dependency-hygiene checks for teams that consume open-source packages. |
Pin and lock every dependency Commit lockfiles and pin exact versions so a build cannot silently pull a newly published release you never reviewed. |
Add a cooldown window on new releases Hold off on adopting brand-new package versions for a set period so freshly published malicious releases age out before they reach production. |
Audit CI/CD tokens and secrets Scope build and publish tokens to least privilege, rotate them on a schedule, and remove long-lived credentials from pipelines. |
Monitor for the published Shai-Hulud IOCs Watch for the indicators vendors and national CERTs have published, and rotate any credential that touched an affected package. |
Source: The CyberSignal, compiled from AFP, FBI and vendor guidance. Defender actions only. |
Defender checklist: four dependency-hygiene steps for open-source consumers in the wake of the TeamPCP arrests.
What Is Confirmed and What Is Not
The core of the announcement is well sourced: the AFP, WAPF and FBI acted jointly, two men were charged on August 26 with 14 offences between them, and officials link the pair to TeamPCP and the Shai-Hulud campaign that reached Mercor and OpenAI. Several points remain open. The AFP has not publicly named the defendants, and while Australian media have identified them, those names are not confirmed by the charging agency here. The AFP has not said whether other members of the group are being pursued, nor has it detailed any cross-border extradition posture. The victim tally of 1,000-plus organizations is an official estimate of potential compromise, not a confirmed list, and beyond Mercor and OpenAI the full roster of affected companies has not been published.
This is also not the first time open-source and AI supply chains have collided in the headlines. It follows OpenAI's own postmortem on its Hugging Face breach, which the company called a "warning shot," and it lands amid a run of coordinated takedowns, from the FBI and DOJ seizure of China-linked intrusion tools to INTERPOL's Operation Jackal IV arrests. The pattern is police agencies moving faster and more jointly against cybercrime networks, even when the damage is already downstream.
My read: The arrests are a genuine win for cross-border policing, but they change nothing about the exposure sitting in your build systems, and treating them as closure would be a mistake. Assessment, not reported fact: the durable lesson here is that credential theft at this scale outlives any single prosecution, so the teams that come out ahead are the ones that already pinned dependencies, throttled new-version adoption, and rotated pipeline tokens before a name ever appeared in a charge sheet. Law enforcement can dismantle the crew. Only the consumers of open-source software can close the door the campaign walked through.
Primary documents:
