Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions — Threadlinqs Intelligence
As of 2026-05-30, Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0256 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · FINANCIAL
On March 19, 2026, threat actor TeamPCP compromised Aqua Security's Trivy vulnerability scanner (v0.69.4), trivy-action (75 of 76 tags), and setup-trivy GitHub Actions by force-pushing malicious
On March 19, 2026 at 17:43:37 UTC, the threat actor group TeamPCP (also known as DeadCatx3, PCPcat, PersyPCP, and ShellForce) executed a sophisticated supply chain attack against Aqua Security's widely-used Trivy vulnerability scanner ecosystem. This marks the second distinct compromise of the Trivy supply chain in March 2026, following the hackerbot-claw incident on February 28.
The attackers compromised the aqua-bot service account and used it to force-push a malicious v0.69.4 release to the trivy repository, triggering automated release workflows. Simultaneously, they force-pushed malicious commits to 75 of 76 version tags in the aquasecurity/trivy-action repository and 7 tags in aquasecurity/setup-trivy. The only untouched trivy-action tag was 0.35.0 (base commit 57a97c7e). The tag poisoning technique cloned original commit metadata including author names, timestamps, and messages while replacing only the entrypoint.sh payload, making detection through casual inspection extremely difficult.
The malicious payload operates as a three-stage credential stealer:
Stage 1 — Collection: On GitHub-hosted runners, the malware exploits passwordless sudo access to locate the Runner.Worker process and read its memory via /proc/<pid>/mem, searching for the JSON pattern {"value":"<secret>","isSecret":true} to extract all GitHub Actions secrets. On self-hosted runners and developer machines, a comprehensive filesystem credential stealer (self-identified in code comments as 'TeamPCP Cloud stealer') systematically searches 50+ sensitive file paths for SSH keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), GCP service account keys, Azure tokens, Kubernetes service account tokens and kubeconfig files, Docker configs, database credentials, Terraform state files, VPN configurations, shell histories, and cryptocurrency wallets (Bitcoin, Solana, Ethereum, Cardano). The malware also enumerates network interfaces and harvests all environment variables from the runner process.
Stage 2 — Encryption: Collected credentials are bundled into tpcp.tar.gz, then encrypted using AES-256-CBC with PBKDF2 key derivation, with the session key wrapped using RSA-4096 OAEP. The resulting bundle contains payload.enc and session.key.enc.
Stage 3 — Exfiltration: The encrypted bundle is sent via HTTPS POST to the typosquatted C2 domain scan.aquasecurtiy.org (note the transposed 'i' and 'y' in 'security') at IP 45.148.10.212 (TECHOFF SRV LIMITED, Amsterdam), with a custom X-Filename header. If the primary C2 is unreachable and a GitHub PAT is available, the malware falls back to creating a public repository named tpcp-docs on the victim's GitHub account and uploading stolen data as a release asset.
On developer machines (detected via GITHUB_ACTIONS != 'true'), the malicious Trivy binary deploys a Python dropper to ~/.config/systemd/user/sysmon.py with systemd unit integration for persistence. This dropper polls a secondary C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io (ICP-hosted) after a 5-minute sleep interval, enabling arbitrary payload execution on compromised developer workstations.
A third C2 endpoint, plug-tab-protective-relay.trycloudflare.com, was identified via Cloudflare Tunnel infrastructure.
The blast radius is significant: over 10,000 GitHub workflow files reference aquasecurity/trivy-action, and any pipeline that ran using a compromised version tag between March 19-20 executed the credential stealer before the legitimate Trivy scan. The Homebrew project performed an emergency downgrade (PR #273304). Detection artifacts include missing GPG signatures on compromised commits, impossible commit timestamps (2020-era dates with 2026 parents), and the distinctive 'tpcp-docs' repository creation on victim accounts.
TeamPCP is a cloud-native threat group active since at least November 2025, known for exploiting misconfigured Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers using automated worm-driven campaigns. The group has comp
Weaknesses (CWE)
CWE-94, CWE-200, CWE-506, CWE-829
Target sectors: technology, devops, cloud-infrastructure, financial, healthcare, government, software-development
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1059, T1543, T1053, T1027, T1036, T1070, T1528, T1552