Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking) — Threadlinqs Intelligence
As of 2026-05-30, Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking) is a critical-severity supply chain threat attributed to TeamPCP (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0274 · Severity: CRITICAL · CVSS: 9.8 · Status: RESOLVED · Category: SUPPLY_CHAIN
Attribution: TeamPCP · N/A · FINANCIAL
On March 23, 2026, threat actor TeamPCP hijacked 35 release tags on the Checkmarx KICS GitHub Action (kics-github-action) between 12:58-16:50 UTC, injecting a credential-stealing payload (setup.sh)
TeamPCP, a cloud-native threat actor also tracked as DeadCatx3, PCPcat, and ShellForce, compromised the Checkmarx KICS GitHub Action (Checkmarx/kics-github-action) on March 23, 2026, by hijacking the cx-plugins-releases service account (GitHub ID 225848595) to force-push 35 malicious tags spanning versions v1 through v2.1.20.
The attack injected a malicious setup.sh script into each compromised tag, redirecting them to imposter commits containing the TeamPCP Cloud Stealer payload. The malware operates in multiple stages: first enumerating CI/CD runner processes (targeting Runner.Worker) and reading process memory via /proc/<pid>/mem to extract secrets stored as JSON structures matching {"value":"<secret>","isSecret":true}. It then performs filesystem harvesting across 50+ sensitive paths including AWS, Azure, and GCP credentials, SSH keys, Kubernetes tokens, database configs, TLS private keys, and cryptocurrency wallets.
Collected credentials are encrypted using AES-256-CBC with a randomly generated session key, which is then wrapped with a hardcoded 4096-bit RSA public key matching the same key used in the Trivy attack five days prior. The encrypted bundle (tpcp.tar.gz) is exfiltrated via HTTPS POST to the newly registered checkmarx.zone domain. As a fallback mechanism, if the primary C2 is unreachable, the malware uses the victim's GITHUB_TOKEN to create a repository named docs-tpcp and uploads the stolen data as a release asset.
The attack also includes persistence capabilities: on non-CI/CD environments (where GITHUB_ACTIONS != "true"), the malware drops a systemd service (sysmon) that polls an ICP canister C2 (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io) every 50 minutes and executes downloaded payloads. On Kubernetes-enabled hosts, the malware deploys privileged DaemonSet pods.
The compromise was discovered when a community member (cyril-flieller) filed GitHub Issue #152 at 15:56 UTC on March 23. The repository was taken offline at 16:50 UTC, restored at 18:59 UTC with clean tags. The master branch was never compromised — only release tags were affected.
This attack is part of a coordinated campaign by TeamPCP that began with the Trivy GitHub Action compromise on March 19 (75 of 76 tags hijacked), expanded into the npm ecosystem via the CanisterWorm self-propagating worm on March 20, and pivoted to KICS on March 23. The root cause traces back to incomplete credential rotation following an initial breach of Aqua Security's aqua-bot service account on February 27, 2026. TeamPCP's demonstrated ability to compromise multiple security scanner supply chains in rapid succession, combined with multi-stage payload evolution (8+ versions of kamikaze.sh in 48 hours), sophisticated C2 infrastructure (Cloudflare Tunnels, ICP blockchain, GitHub dead drops), and cross-ecosystem propagation (GitHub Actions to npm to Docker Hub), represents a significant escalation in CI/CD supply chain attack capability.
KICS (Keeping Infrastructure as Code Secure) is a widely-used open-source IaC security scanner supporting Terraform, CloudFormation, Ansible, Docker, Kubernetes, and other IaC frameworks. The GitHub Action is used in CI/CD pipelines to scan infrastructure code for misconfigurations and security vulnerabilities, making it a high-value target for supply chain attacks targeting security-conscious organizations.
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829, CWE-912, CWE-522
Target sectors: technology, cloud-security, devops, financial, government, healthcare, software-development
Target regions: Global, North America, Europe, Asia Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1199, T1059, T1543, T1547, T1027, T1140, T1070, T1555, T1552