# Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)

> On March 23, 2026, threat actor TeamPCP hijacked 35 release tags on the Checkmarx KICS GitHub Action (kics-github-action) between 12:58-16:50 UTC, injecting a credential-stealing payload (setup.sh) that exfiltrates CI/CD secrets via the checkmarx.zone C2 domain. This is the second major security scanner GitHub Action compromised by TeamPCP within five days, following the Trivy GitHub Action attack on March 19.

- **Published:** 2026-03-23T12:00:00Z
- **Last reviewed:** 2026-03-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0274
- **ID:** TL-2026-0274
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TeamPCP, a cloud-native threat actor also tracked as DeadCatx3, PCPcat, and ShellForce, compromised the Checkmarx KICS GitHub Action (Checkmarx/kics-github-action) on March 23, 2026, by hijacking the cx-plugins-releases service account (GitHub ID 225848595) to force-push 35 malicious tags spanning versions v1 through v2.1.20.

The attack injected a malicious setup.sh script into each compromised tag, redirecting them to imposter commits containing the TeamPCP Cloud Stealer payload. The malware operates in multiple stages: first enumerating CI/CD runner processes (targeting Runner.Worker) and reading process memory via /proc/<pid>/mem to extract secrets stored as JSON structures matching {"value":"<secret>","isSecret":true}. It then performs filesystem harvesting across 50+ sensitive paths including AWS, Azure, and GCP credentials, SSH keys, Kubernetes tokens, database configs, TLS private keys, and cryptocurrency wallets.

Collected credentials are encrypted using AES-256-CBC with a randomly generated session key, which is then wrapped with a hardcoded 4096-bit RSA public key matching the same key used in the Trivy attack five days prior. The encrypted bundle (tpcp.tar.gz) is exfiltrated via HTTPS POST to the newly registered checkmarx.zone domain. As a fallback mechanism, if the primary C2 is unreachable, the malware uses the victim's GITHUB_TOKEN to create a repository named docs-tpcp and uploads the stolen data as a release asset.

The attack also includes persistence capabilities: on non-CI/CD environments (where GITHUB_ACTIONS != "true"), the malware drops a systemd service (sysmon) that polls an ICP canister C2 (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io) every 50 minutes and executes downloaded payloads. On Kubernetes-enabled hosts, the malware deploys privileged DaemonSet pods.

The compromise was discovered when a community member (cyril-flieller) filed GitHub Issue #152 at 15:56 UTC on March 23. The repository was taken offline at 16:50 UTC, restored at 18:59 UTC with clean tags. The master branch was never compromised — only release tags were affected.

This attack is part of a coordinated campaign by TeamPCP that began with the Trivy GitHub Action compromise on March 19 (75 of 76 tags hijacked), expanded into the npm ecosystem via the CanisterWorm self-propagating worm on March 20, and pivoted to KICS on March 23. The root cause traces back to incomplete credential rotation following an initial breach of Aqua Security's aqua-bot service account on February 27, 2026. TeamPCP's demonstrated ability to compromise multiple security scanner supply chains in rapid succession, combined with multi-stage payload evolution (8+ versions of kamikaze.sh in 48 hours), sophisticated C2 infrastructure (Cloudflare Tunnels, ICP blockchain, GitHub dead drops), and cross-ecosystem propagation (GitHub Actions to npm to Docker Hub), represents a significant escalation in CI/CD supply chain attack capability.

KICS (Keeping Infrastructure as Code Secure) is a widely-used open-source IaC security scanner supporting Terraform, CloudFormation, Ansible, Docker, Kubernetes, and other IaC frameworks. The GitHub Action is used in CI/CD pipelines to scan infrastructure code for misconfigurations and security vulnerabilities, making it a high-value target for supply chain attacks targeting security-conscious organizations.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1565 Data Manipulation

## Sources

- [Wiz Blog: KICS GitHub Action Compromised - TeamPCP Strikes Again](https://www.wiz.io/blog/teampcp-attack-kics-github-action)
- [Wiz Blog: Trivy Compromised by TeamPCP - Supply Chain Attack Analysis](https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack)
- [CrowdStrike: From Scanner to Stealer - Inside the trivy-action Supply Chain Compromise](https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/)
- [GitHub Issue #152: CRITICAL SECURITY ADVISORY - KICS Repository Compromised](https://github.com/Checkmarx/kics-github-action/issues/152)
- [Rami McCarthy: Trivy Supply Chain Compromise - TeamPCP Attack Timeline and IOCs](https://ramimac.me/trivy-teampcp/)
- [The Hacker News: Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked](https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html)
- [BleepingComputer: Trivy Vulnerability Scanner Breach Pushed Infostealer via GitHub Actions](https://www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/)
- [Socket.dev: Trivy Under Attack Again - Widespread GitHub Actions Tag Compromise](https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise)
- [Snyk: Trivy GitHub Actions Supply Chain Compromise Analysis](https://snyk.io/articles/trivy-github-actions-supply-chain-compromise/)
- [CSA Labs: CanisterWorm - Blockchain C2 in CI/CD Supply Chain Attack](https://labs.cloudsecurityalliance.org/research/csa-research-note-canisterworm-blockchain-c2-supply-chain-20/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0274