TLDR Tech / InfoSec
TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials
TeamPCP, the group behind the Trivy supply chain attack (CVE-2026-33634, CVSS 9.4), compromised two Checkmarx GitHub Actions, checkmarx/ast-github-action and checkmarx/kics-github-action, by reusing credentials stolen from the Trivy breach four days earlier. The "TeamPCP Cloud stealer" harvests SSH keys, AWS/GCP/Azure creds, Kubernetes configs, Docker secrets, and crypto wallet data, exfiltrating them as an encrypted archive to checkmarx[.]zone. Trojanized Open VSX extensions for VS Code were also pushed.
Read the full story