Google's undercover analyst infiltrated hacking gang TeamPCP, aiding arrests

Google's Threat Intelligence team revealed that an undercover researcher infiltrated the hacking group TeamPCP, enabling the company to monitor its activities, warn victims, and pass identifying details to law enforcement, leading to arrests. Researcher Austin Larsen exploited operational security lapses by one of two Australians accused in the group, gaining access to a server storing stolen credentials. Google used this data to alert victims and disrupt attacks, while also receiving intelligence from rival cybercriminal group ShinyHunters. Google's visibility uncovered a potential zero-day exploit targeting login software, which could bypass two-factor authentication, and the company recovered the code. Investigators linked a key hacker to a Gmail account with stolen credentials backed up on Google Drive, and the FBI passed findings to Australian police, who arrested the alleged hacker about a month later.