Meet CAI: The Cloud Worm That Mugs Other Malware Before Robbing You

There's a new piece of nastiness making the rounds in cloud environments, and it has the charming habit of evicting rival malware before settling in to steal your credentials and mine cryptocurrency on your dime.

Dubbed the Cloud AI Infrastructure Attack Framework (CAI), it's a centrally controlled botnet that goes after the kind of developer tooling that underpins modern cloud infrastructure: Docker, Kubernetes, Redis, etcd, Kubelet, and Ray. The goal is straightforward enough — harvest credentials, mine crypto, repeat.

What makes CAI slightly more interesting than the average cloud pest is how nakedly it cribs from its competition. Security researcher Michael Rippey at Hunt.io, who first spotted it on June 15, notes the scripts contain code comments like 'PCPJack-aligned' and were clearly written with rival malware in mind. Not just inspired by it — actively hostile toward it. CAI explicitly hunts down and terminates processes belonging to both TeamPCP and PCPJack before getting to work on the actual victim.

For context: TeamPCP is the crew behind a cluster of worms including mini Shai-Hulud, Miasma, and Canister, all of which have been quietly poisoning open source registries and hoovering up cloud tokens, API keys, and access credentials since the Trivy supply-chain attack earlier this year. PCPJack is a newer operation that mimics TeamPCP's approach while also deleting TeamPCP's own artifacts from compromised systems — thieves stealing from thieves.

CAI appears to have watched all of this and decided to out-compete both of them.

Hunt.io tracked the operator across three open directories over roughly three weeks in June. The progression was deliberate: early activity showed someone testing worm code that borrowed TTPs from PCPJack, before the operation moved into full deployment. Rippey describes the codebase as showing 'signs of LLM-assisted development,' which is becoming a fairly common observation with this class of threat.

The framework itself isn't technically impressive. Rippey is candid about that. But it works. A scanning engine feeds targets into automated exploit queues, with centralised command-and-control coordinating the whole operation. Once a host is compromised, it receives a miner, a credential stealer, and a Python backdoor. Recent C2 logs confirm active exploitation attempts, and cryptocurrency wallet activity suggests multiple successful hits.

What this really illustrates is that the cloud worm ecosystem is getting competitive. TeamPCP, PCPJack, and now CAI are all targeting the same infrastructure, increasingly stepping on each other's toes. The threat landscape here isn't one organised adversary — it's a scramble, with multiple groups racing to monetise the same exposed services.

For anyone running cloud-native infrastructure, the attack surface these tools exploit isn't new or exotic. Misconfigured Docker sockets, exposed Redis instances, unauthenticated Kubelet APIs — these have been on the list for years. The difference now is that there's an expanding pool of actors with tooling refined enough to exploit them at scale, and they're clearly watching each other's techniques and iterating fast.