The TeamPCP group is reported to be compromising organizations by weaponizing security scanning tools integrated into CI/CD pipelines, turning a defensive control into an entry point. Post-compromise activity has been observed to include cloud environment enumeration, indicating attackers move beyond the build pipeline into broader infrastructure. Organizations running security scanners in automated pipelines face elevated risk of supply chain compromise, credential theft, and cloud resource exposure; campaign activity is ongoing.