https://spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws[.]com/bootstrap.sh 🤔 "# System Performan...

Summary

A malicious shell script hosted on a spoofed AWS S3 domain (spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws[.]com) was used to deliver TeamPCP (also known as PCPcat) malware. The script masquerades as a "System Performance Monitor Bootstrap" and was delivered via React2Shell exploitation. Security researchers are warning of the need to detect and remove the TeamPCP malware from affected systems.

Indicators of Compromise

• domain — spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws[.]com
• url — https://spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws[.]com/bootstrap.sh
• malware — TeamPCP
• malware — PCPcat

Entities