CI Runner.Worker bash entrypoint.sh/setup.sh spawning curl POST (TeamPCP stealer

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•0•0•1

Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.