🕵️ Lapsus$

The items that name it 6

• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas threat actors2026-10-16It is written here as Lapsus$ (stolen access reportedly handed off to them for extortion campaigns).

  stolen access reportedly handed off to them for extortion campaigns

• The OpenSourceMalware Show #23
  talkas classification.key entities2026-10-02
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas threat actors2026-09-25It is written here as LAPSUS$ (threat group specializing in stolen credentials to pivot into Azure AD, registering rogue trusted devices).

  threat group specializing in stolen credentials to pivot into Azure AD, registering rogue trusted devices

• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• Cloud Threat Highlights: H1 2026
  writeupas threat actors2026-08-06

  Jointly listed GitHub internal repositories for sale with TeamPCP, pricing access at over $50,000; in at least one case extorted a customer initially compromised via a key stolen in a TeamPCP campaign.

• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas threat actors2026-05-20

  Group with reporting pointing to overlapping claims alongside Vect and ShinyHunters in the same credential-theft pipeline, making attribution messy