Product Not yet confirmed elsewhere 1 publisher 3 min read Published Aug 27, 2026, 12:25 PM PDT

Flare traced TeamPCP's GitHub handle to a HackerOne profile carrying a real name

Australian Federal Police arrested two men over malicious code the agency estimates reached more than 1,000 organisations. What identified the alleged leader was a screen name he kept using on other platforms.

The Product Desk

How we use AI Send a correction

Photo: pcmag.com

What happened

Law enforcement arrested two men in Australia on Thursday over their alleged part in TeamPCP, a hacking group that has been spreading malware through open-source software tools.
The Australian Federal Police estimates the malicious code potentially compromised more than 1,000 organisations globally, enabled theft of more than 500,000 credentials and moved at least 300 gigabytes out.
PCMag reports that one suspect's attachment to a single online screen name, carried across platforms, likely helped investigators catch him.
Brian Krebs interviewed the same suspect last month under the alias Ellis, and reported that he expressed no remorse and said he would accept the consequences if arrested.
Ruben Thomson, 21, and Louis Michael Gaebler, 23, have been charged with 14 offenses between them and were scheduled to appear in a local court in Australia later the same day.

Why it matters

exposure With no package names and no victim list in the reporting, an organisation inside the AFP's 1,000 has no way to confirm it and no notification coming; the checking has to start from its own install history.
constraint Attribution here rested on the actor's own alias hygiene, so it gives defenders nothing repeatable: the next crew that keeps its handles separate and stays off public channels leaves no first thread to pull.
decision Teams now have to settle whether developer tooling gets the same publisher review as production dependencies, given that the losses landed in credentials held on developer machines rather than in customer data.

The developer who pulled a utility off GitHub last year was not being careless. That is where the utilities are. TeamPCP hosted its own tools there too, under an account linked to the alias DeadCatx3 ^[3], and everything the Australian Federal Police counted afterwards came out the far end of that ordinary path.

Divide the credential and data totals by the AFP's own count of affected organisations and the average victim contributed roughly 500 credentials ^[15] and roughly 300 megabytes of data ^[16]. No real victim sits on an average; one gives up a laptop keychain and the next gives up a CI secret store. But the per-organisation figure is the one a security lead can hold against their own environment, and it reads closer to a developer's stored logins than to a customer database.

According to Flare, the DeadCatx3 handle from GitHub also existed on HackerOne, where an account registered in June 2025 listed its owner's full name ^[5]^[6]. "The account in question had the name Ruben Thomson connected to it. It can't be that easy, can it?" the firm wrote ^[7]. Flare then matched a cartoon cat in a hoodie, used as the avatar on a Steam account traced to Thomson, with the profile picture in a screenshot of TeamPCP's Telegram account, and said it was highly confident he led the group ^[8]^[9]. Flare also described TeamPCP as "loud by choice", posting on Telegram and X until the account was shut down ^[10], and said a group talking that much under that many aliases "hands you the first thread to pull" ^[11].

None of that is a security product. The published trail runs through a bug bounty profile and a games-platform avatar, and no scanner or registry control appears anywhere in it ^[17]. That is the distance between what dependency tooling is sold on, which is catching the payload, and what actually produced a name here, which was a 21-year-old's attachment to a handle ^[4]^[19].

Two questions sort most of the intake problem, and they work on artifacts already installed rather than on the next procurement cycle. Does this thing run on a machine holding long-lived credentials, or only inside a build that gets thrown away? And does anything in the pipeline record which human account published the exact version that landed? Developer tooling usually answers yes to the first and nothing at all to the second, and the AFP's totals describe what that square of the grid pays out when the publisher turns out to be hostile. The reporting names neither the packages nor the victim organisations ^[18], so nobody gets told they were in the 1,000; the inventory that answers the question covers the laptops and build runners where developers keep their tokens.

What to watch

Whether the AFP or Flare publishes the affected package and repository names, which is what would let a team check its own build logs against the 1,000 figure.
What the court does with the 14 charges at the scheduled appearance, and how they are split between the two men.
Whether GitHub or HackerOne comment on the accounts that carried the DeadCatx3 handle on their platforms.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence45
Adoption52
Hype gap+18
Incentives62
Confidence55

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
On Thursday, law enforcement arrested two men in Australia who are allegedly part of TeamPCP, a hacking gang that has been spreading malware through open-source software tools.
Reported SupportedView cited source
[2]
The Australian Federal Police said it is estimated the malicious code potentially compromised more than 1,000 organisations globally, enabling the theft of more than 500,000 credentials and the exfiltration of at least 300 gigabytes of data.
Reported Supported Source: Australian Federal Police, as reported by PCMagView cited source
[3]
TeamPCP has been linked to the alias DeadCatx3 via an account on the software development platform GitHub, which the group used to host its tools.
Reported SupportedView cited source
[4]
One of the reported suspects, 21-year-old Ruben Thomson, was not hard to identify because of his association with the screen name DeadCatx3, according to a report by cybersecurity provider Flare.
Reported Supported Source: FlareView cited source
[5]
Flare checked whether the DeadCatx3 handle was registered on other platforms and found it on HackerOne, a bug bounty platform security researchers use to submit software vulnerabilities.
Reported Supported Source: FlareView cited source
[6]
A HackerOne user registered an account with the DeadCatx3 handle in June 2025 and also listed their full name on the profile.
Reported Supported Source: FlareView cited source
[7]
Flare wrote: "The account in question had the name Ruben Thomson connected to it. It can't be that easy, can it?"
Reported Supported Source: FlareView cited source
[8]
Flare found a wider web of accounts traced back to Thomson, including a Steam account featuring a unique picture of a cartoon cat in a hoodie sitting in front of computer monitors, and found a screenshot of the TeamPCP Telegram account using the same profile picture.
Reported Supported Source: FlareView cited source
[9]
Flare concluded that the matching profile pictures signalled with high confidence that Ruben Thomson is the leader of TeamPCP.
Reported Supported Source: FlareView cited source
[10]
Flare said TeamPCP was "loud by choice" and frequently posted on their Telegram channel and on X before their account was shut down.
Reported Supported Source: FlareView cited source
[11]
Flare said: "A group that talks this much, this publicly, under this many aliases, doesn't just invite scrutiny, but it hands you the first thread to pull."
Reported Supported Source: FlareView cited source
[12]
Cybersecurity journalist Brian Krebs interviewed Thomson last month before his arrest; using the alias Ellis, Thomson expressed no remorse over his cybercrime activities, said he was grateful for the friendships built through TeamPCP, and told KrebsOnSecurity he would accept the consequences if he was ever arrested.
Reported Supported Source: KrebsOnSecurityView cited source
[13]
Australian Federal Police also reportedly arrested a 23-year-old named Louis Michael Gaebler.
Reported SupportedView cited source
[14]
Together, both suspects have been charged with 14 offenses and were scheduled to appear in a local court in Australia later the same day.
Reported SupportedView cited source
[15]
Spread evenly across the AFP's victim estimate, the credential theft works out to roughly 500 credentials per affected organisation.
Derived Supported1 source— create a free account to open them
[16]
Spread evenly across the AFP's victim estimate, the exfiltrated data works out to roughly 300 megabytes per affected organisation.
Derived Supported1 source— create a free account to open them
[17]
The published account of the investigation describes no defensive product or control that detected the malicious code; the identification path it reports runs through reused handles on GitHub, HackerOne, Steam and Telegram plus the group's own public posting.
Derived Supported1 source— create a free account to open them
[18]
The reporting does not identify the affected open-source packages or repositories, and names no victim organisation.
Derived Supported1 source— create a free account to open them
[19]
PCMag reported that the hacker's reuse of an online screen name likely helped investigators catch him.
Reported Insufficient Source: PCMag2 sources— create a free account to open them View cited source

Sources

1 independent publisher whose own reporting we read for this story.

pcmag.com
1 article · August 27, 2026
Rookie Mistake: Hacker's Attachment to Screen Name Made Him Easy to Catch | PCMag

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For builders, the reported facts are that malware was distributed through open-source software tools hosted in part via a GitHub account tied to the alias DeadCatx3, and that the AFP estimates more than 1,000 organisations were potentially compromised. The single source names no packages, repositories or victims, so a dependency-consuming team cannot check its own exposure from this reporting. The concrete builder-relevant lesson is narrower and better evidenced: the entire published identification chain runs through reused developer-adjacent identities (GitHub, HackerOne, Steam, Telegram), and no scanning or registry control appears anywhere in the detection path.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence45: 0100
Single-outlet retelling of a vendor report plus an official statement
Load-bearing facts are attributable: an AFP statement is quoted directly for impact and charges, and Flare's report is quoted for each attribution step, with KrebsOnSecurity cited as independent prior reporting. But the cluster has exactly one publisher and no primary documents - no charge sheet, no AFP release link, no Flare report excerpt beyond quotes - and the reporting names no affected package, repository or victim, so the scope claims cannot be independently checked.
Adoption52: 0100
Real-world incident with arrests and an official scope estimate
This is not a technology-uptake story, so adoption is read as demonstrated real-world consequence. That consequence is concrete at the enforcement end - two named suspects arrested, 14 charges, scheduled court appearance - and quantified at the victim end only by an AFP estimate covering 1,000-plus unnamed organisations. Nothing in the reporting shows victim notification, incident response or package removal, which keeps this mid-range rather than high.
Hype gap+18: −100 understated0 aligned+100 overstated
Framing overstates the causal link between handle reuse and arrest
The verifiable facts - the handle pivot, the avatar match, the AFP figures, the arrests - are reported soberly and with attribution. Overstatement sits in the causal frame: headline and lede assert the reused screen name 'likely helped investigators catch him,' while no law-enforcement account of investigative method appears, and the underlying vendor report is an after-the-fact OSINT reconstruction with commercial value to its author. The gap is modest, not severe, because the numbers themselves are officially sourced and hedged.
Incentives62: 0100
Vendor attribution report and enforcement announcement both benefit from amplification
Two disclosing parties have visible interests. Flare is identified in the source as a cybersecurity provider whose 'new report' supplies the entire investigative narrative and demonstrates its OSINT capability; the AFP is announcing an enforcement success and supplies the impact figures that make the case newsworthy. Neither interest is concealed - the source labels Flare a vendor - but the reporting relies on both parties' framing without independent verification.
Confidence55: 0100
Moderate: specific attributed facts, single publisher, unverified scope
Confidence is moderate. The identity-attribution and enforcement facts are specific, internally consistent and echoed by cited independent reporting from KrebsOnSecurity, which raises trust in the core narrative. It is held down by one-publisher coverage, sole reliance on vendor and agency framing, absent primary documents, unnamed packages and victims, and a headline causal claim that no cited investigator confirms.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Cybercrime Law Enforcement Operations Follow
OSINT attribution and deanonymisationFollow
Software Supply Chain Security Follow
Threat intelligence vendor researchFollow
Credential Theft and Stealer Logs Follow