Poisoned Pipeline / Incidents / AS209
TeamPCP backdoored the Cemu 2.6 Linux release assets
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
supply-chain campaign
Backdoor/RAT payload documented by the cited sources.
Credential or wallet material targeted.
Sources
- https://securitylabs.datadoghq.com/articles/backdoored-cemu-release-teampcp-supply-chain-campaign/
- https://corgea.com/research/cemu-linux-release-assets-teampcp-malware
- https://github.com/cemu-project/Cemu/issues/1911
- https://www.gamingonlinux.com/2026/05/popular-emulator-cemu-was-recently-compromised-with-malware-in-linux-downloads/
- https://www.xda-developers.com/20000-linux-users-grabbed-malicious-cemu-build-steals-passwords-coding-cloud-credentials/
- https://www.neowin.net/news/popular-wii-u-emulator-cemu-has-been-offering-compromised-downloads-for-days/