TeamPCP Data Exfiltration Header

Elgonad .@elgonad

•updated Mar 25, 2026•9•0•164

Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz'. This custom header is used by the TeamPCP credential harvester to exfiltrate collected sensitive credentials (cloud, database, SSH, Kubernetes) to an attacker-controlled server following the compromise of the litellm PyPI package.