# Checkmarx KICS GitHub Actions trojanised by TeamPCP

> Between 12:58 and 16:50 UTC on 23 March 2026, TeamPCP hijacked 35 tags in the Checkmarx `ast-github-action` and `kics-github-action` repos to push a credential stealer, leveraging tokens stolen from the Trivy compromise. CI/CD pipelines using either Action during the window executed the stealer before the legitimate scan.

- Published: 2026-03-23
- Severity: high
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: GitHub Actions
- Scope: 2 packages, 0 compromised versions
- Tags: ci-cd-compromise, credential-theft, maintainer-takeover, infostealer
- Threat actor: TeamPCP
- Also known as: TeamPCP Checkmarx cascade
- Detected by: Checkmarx, Microsoft Threat Intelligence
- Incident ID: github-actions-2026-03-23-checkmarx-kics

## Affected packages (2)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [checkmarx/ast-github-action](https://dependencywatch.io/package/github-actions/checkmarx/ast-github-action) | GitHub Actions |  |
| [checkmarx/kics-github-action](https://dependencywatch.io/package/github-actions/checkmarx/kics-github-action) | GitHub Actions |  |

## What happened

Between `12:58 UTC` and `16:50 UTC` on `2026-03-23`, **TeamPCP** hijacked `35` tags across the Checkmarx `ast-github-action` and `kics-github-action` repositories, force-pushing them to commits that prepended a credential stealer to the legitimate scan logic. Access was obtained using a maintainer GitHub PAT exfiltrated from the earlier `2026-03-19` Trivy compromise.

## Stealer behaviour

The injected step runs before the real scan, dumps the runner environment, `secrets.*` mounted into the workflow, the `GITHUB_TOKEN`, OIDC tokens, AWS / GCP / Azure credentials, and any Kubernetes kubeconfig that happens to be on disk, then POSTs the package to `audit.checkmarx.cx` (an attacker-controlled domain that mimics Checkmarx infrastructure) with `checkmarx.zone` as a fallback. After exfil it calls the legitimate KICS scanner so the workflow appears to succeed.

## Blast radius

Any CI run that referenced `checkmarx/kics-github-action@main`, `@v2`, `@v2.1`, or any other tag during the ~4 hour window executed the stealer. The Bitwarden CLI compromise on `2026-04-22` was a direct downstream consequence - TeamPCP used a PAT lifted from a Bitwarden engineer's pipeline run.

## Response

Checkmarx rotated their signing keys, restored clean tags, and published a SHA pinning advisory on `2026-03-24`. Microsoft's Trivy write-up of the same day folds Checkmarx into the broader TeamPCP cascade timeline.

## Impact

- Any CI run using the affected Actions on @main during the window exfiltrated secrets
- Cloud credentials, GitHub PATs, Kubernetes tokens harvested
- Bitwarden CLI compromise (April 22) was a direct downstream consequence

## What to do

1. Pin `kics-github-action` to `v2.1.20` or later; pin `ast-github-action` by commit SHA
2. Rotate every secret exposed to KICS workflows between 23 March `12:58 UTC` and `16:50 UTC`
3. Block egress to `checkmarx.zone` and `audit.checkmarx.cx`

## References

- [Detecting, investigating, and defending against the Trivy supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/) - Microsoft
- [Update: Ongoing Checkmarx Supply Chain Security Incident](https://checkmarx.com/blog/ongoing-security-updates/) - Checkmarx
- [Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags](https://www.stepsecurity.io/blog/checkmarx-kics-github-action-compromised-malware-injected-in-all-git-tags) - Step Security

---

Canonical page: https://dependencywatch.io/incident/github-actions-2026-03-23-checkmarx-kics
Markdown version: https://dependencywatch.io/incident/github-actions-2026-03-23-checkmarx-kics.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).