Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
Checkmarx KICS GitHub Action Supply Chain Compromise by (TL-2026-0274), also tracked as TeamPCP KICS Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-23. It is attributed to TeamPCP with high confidence, affects Checkmarx kics-github-action, maps to 24 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0274
- Threat ID
- TL-2026-0274
- Also known as
- TeamPCP KICS Campaign, KICS Tag Hijacking
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L)
- Status
- RESOLVED
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-23
- Last reviewed
- 2026-03-23
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud-security, devops, financial, government, healthcare, software-development
- Target regions
- Global, North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Checkmarx KICS GitHub Action Supply Chain Compromise by
Malware and tooling: CanisterWorm, TeamPCP Cloud Stealer, ICP Canister tdtqy-oyaaa-aaaae-af2dq-cai
On March 23, 2026, threat actor TeamPCP hijacked 35 release tags on the Checkmarx KICS GitHub Action (kics-github-action) between 12:58-16:50 UTC, injecting a credential-stealing payload (setup.sh) that exfiltrates CI/CD secrets via the checkmarx.zone C2 domain. This is the second major security scanner GitHub Action compromised by TeamPCP within five days, following the Trivy GitHub Action attack on March 19.
How Checkmarx KICS GitHub Action Supply Chain Compromise by works
TeamPCP, a cloud-native threat actor also tracked as DeadCatx3, PCPcat, and ShellForce, compromised the Checkmarx KICS GitHub Action (Checkmarx/kics-github-action) on March 23, 2026, by hijacking the cx-plugins-releases service account (GitHub ID 225848595) to force-push 35 malicious tags spanning versions v1 through v2.1.20.
The attack injected a malicious setup.sh script into each compromised tag, redirecting them to imposter commits containing the TeamPCP Cloud Stealer payload. The malware operates in multiple stages: first enumerating CI/CD runner processes (targeting Runner.Worker) and reading process memory via /proc/<pid>/mem to extract secrets stored as JSON structures matching {"value":"<secret>","isSecret":true}. It then performs filesystem harvesting across 50+ sensitive paths including AWS, Azure, and GCP credentials, SSH keys, Kubernetes tokens, database configs, TLS private keys, and cryptocurrency wallets.
Collected credentials are encrypted using AES-256-CBC with a randomly generated session key, which is then wrapped with a hardcoded 4096-bit RSA public key matching the same key used in the Trivy attack five days prior. The encrypted bundle (tpcp.tar.gz) is exfiltrated via HTTPS POST to the newly registered checkmarx.zone domain. As a fallback mechanism, if the primary C2 is unreachable, the malware uses the victim's GITHUB_TOKEN to create a repository named docs-tpcp and uploads the stolen data as a release asset.
The attack also includes persistence capabilities: on non-CI/CD environments (where GITHUB_ACTIONS != "true"), the malware drops a systemd service (sysmon) that polls an ICP canister C2 (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io) every 50 minutes and executes downloaded payloads. On Kubernetes-enabled hosts, the malware deploys privileged DaemonSet pods.
The compromise was discovered when a community member (cyril-flieller) filed GitHub Issue #152 at 15:56 UTC on March 23. The repository was taken offline at 16:50 UTC, restored at 18:59 UTC with clean tags. The master branch was never compromised — only release tags were affected.
This attack is part of a coordinated campaign by TeamPCP that began with the Trivy GitHub Action compromise on March 19 (75 of 76 tags hijacked), expanded into the npm ecosystem via the CanisterWorm self-propagating worm on March 20, and pivoted to KICS on March 23. The root cause traces back to incomplete credential rotation following an initial breach of Aqua Security's aqua-bot service account on February 27, 2026. TeamPCP's demonstrated ability to compromise multiple security scanner supply chains in rapid succession, combined with multi-stage payload evolution (8+ versions of kamikaze.sh in 48 hours), sophisticated C2 infrastructure (Cloudflare Tunnels, ICP blockchain, GitHub dead drops), and cross-ecosystem propagation (GitHub Actions to npm to Docker Hub), represents a significant escalation in CI/CD supply chain attack capability.
KICS (Keeping Infrastructure as Code Secure) is a widely-used open-source IaC security scanner supporting Terraform, CloudFormation, Ansible, Docker, Kubernetes, and other IaC frameworks. The GitHub Action is used in CI/CD pipelines to scan infrastructure code for misconfigurations and security vulnerabilities, making it a high-value target for supply chain attacks targeting security-conscious organizations.
MITRE ATT&CK techniques used in TL-2026-0274
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
collection
T1005 Data from Local System; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
impact
resource-development
Affected products and versions in Checkmarx KICS GitHub Action Supply Chain Compromise by
- Checkmarx — kics-github-action
Vulnerable versions: v1; v1.0; v1.1; v1.2; v1.3; v1.4; v1.5; v1.6; v1.7; v2
Fixed in: All tags restored after 2026-03-23T18:59Z - Checkmarx — KICS (Keeping Infrastructure as Code Secure)
Vulnerable versions: GitHub Action tags v1 through v2.1.20 (35 tags) during attack window
Fixed in: Tags restored 2026-03-23T18:59Z
Remediation for Checkmarx KICS GitHub Action Supply Chain Compromise by
Patches
- Update kics-github-action to the restored clean version after March 23, 2026 18:59 UTC
- Pin to commit SHA of verified clean release rather than version tag
Immediate actions
- Audit all GitHub Actions workflows referencing Checkmarx/kics-github-action for version tag usage
- Check CI/CD workflow run logs between 2026-03-23T12:58Z and 2026-03-23T16:50Z for signs of compromise
- Search organization repositories for any docs-tpcp repositories indicating successful exfiltration
- Rotate ALL secrets (cloud credentials, SSH keys, API tokens, database passwords) exposed to workflows that ran the compromised action during the attack window
- Block checkmarx.zone and tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io at network perimeter
- Review GitHub audit logs for unauthorized repository creation or token usage
Workarounds
- Temporarily replace kics-github-action with direct KICS CLI installation in workflows
- Use container-based KICS scanning with verified Docker image digests
- Run KICS locally outside of CI/CD until supply chain integrity is confirmed
Longer-term hardening
- Pin all GitHub Actions to full commit SHA hashes instead of mutable version tags
- Implement GitHub Actions allow-listing to restrict which actions can run in your organization
- Deploy Sigstore/cosign verification for GitHub Action provenance
- Enable GitHub code scanning and secret scanning on all repositories
- Implement network egress controls on CI/CD runners to restrict outbound connections
- Monitor for systemd service creation (sysmon, pgmon, pgmonitor, internal-monitor) on self-hosted runners
- Implement least-privilege GITHUB_TOKEN permissions in all workflows
Weaknesses (CWE) in Checkmarx KICS GitHub Action Supply Chain Compromise by
CWE-506, CWE-494, CWE-829, CWE-912, CWE-522
Timeline of Checkmarx KICS GitHub Action Supply Chain Compromise by
- Threat actor MegaGame10418 executes Pwn Request against Aqua Security Trivy CI, exfiltrating aqua-bot PAT via process memory dump — the root cause enabling the broader TeamPCP campaign
- First Trivy compromise occurs with incomplete containment; credential rotation was not atomic, allowing attackers to retain access to refreshed tokens
- TeamPCP hijacks 75 of 76 trivy-action tags and all 7 setup-trivy tags, deploying the TeamPCP Cloud Stealer credential theft payload via compromised aqua-bot account
- TeamPCP deploys CanisterWorm, a self-propagating npm worm using stolen tokens from the Trivy compromise, infecting 28+ packages across multiple npm scopes within 60 seconds
- 44 repositories in aquasec-com internal GitHub org defaced via compromised Argon-DevOps-Mgt token, renamed to tpcp-docs-* prefix between 20:31-20:32 UTC
- Malicious Trivy Docker images (0.69.5, 0.69.6) published to Docker Hub without corresponding GitHub releases; kamikaze.sh payload evolves through 6+ versions including WAV steganography
- KICS GitHub Action repository restored with clean tags at 18:59 UTC; Checkmarx contributor confirms the issue is resolved
- KICS GitHub Action repository taken offline at 16:50 UTC after approximately 4 hours of exposure, ending the active compromise window
- Community member cyril-flieller files GitHub Issue #152 at 15:56 UTC reporting malware injection in all Git tags; Checkmarx begins investigation
- At 12:58 UTC, TeamPCP hijacks 35 KICS GitHub Action tags (v1 through v2.1.20) via compromised cx-plugins-releases service account (GitHub ID 225848595), injecting setup.sh credential stealer payload with checkmarx.zone C2
- As of 2026-05-29, this specific KICS GitHub Action incident is resolved: the ~4-hour tag hijack (Mar 23) was contained and clean tags were restored at 18:59 UTC, with no CVE and no live exploitable artifact remaining. However, actor TeamPCP (UNC6780) is undisrupted and escalating, with a May Checkmarx Jenkins AST Plugin attack superseding it within the same campaign.
Sources cited for Checkmarx KICS GitHub Action Supply Chain Compromise by
- Wiz Blog: KICS GitHub Action Compromised - TeamPCP Strikes Again
- Wiz Blog: Trivy Compromised by TeamPCP - Supply Chain Attack Analysis
- CrowdStrike: From Scanner to Stealer - Inside the trivy-action Supply Chain Compromise
- GitHub Issue #152: CRITICAL SECURITY ADVISORY - KICS Repository Compromised
- Rami McCarthy: Trivy Supply Chain Compromise - TeamPCP Attack Timeline and IOCs
- The Hacker News: Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked
- BleepingComputer: Trivy Vulnerability Scanner Breach Pushed Infostealer via GitHub Actions
- Socket.dev: Trivy Under Attack Again - Widespread GitHub Actions Tag Compromise
- Snyk: Trivy GitHub Actions Supply Chain Compromise Analysis
- CSA Labs: CanisterWorm - Blockchain C2 in CI/CD Supply Chain Attack
Threats related to Checkmarx KICS GitHub Action Supply Chain Compromise by
- Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
- TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography
Detection coverage for TL-2026-0274
As of 2026-03-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0274 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.