TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

Summary: TeamPCP compromised two more GitHub Actions workflows, both maintained by Checkmarx, using an identical credential stealer to the one used in its Trivy supply chain attack, which Sysdig observed about four days after the March 19, 2026 breach. The stealer harvests SSH keys, Git, AWS, Google Cloud, Azure, Kubernetes, Docker, .env files, databases, VPN credentials, CI/CD configurations, cryptocurrency wallet data, and Slack and Discord webhook URLs, exfiltrating an encrypted archive to the typosquat domain checkmarx[.]zone.
Why it matters: The Trivy compromise is tracked as CVE-2026-33634 with a CVSS score of 9.4, and Sysdig's finding that stolen credentials were reused to poison additional actions means one compromised workflow can cascade into others that share write-access tokens. Checkmarx says it is not aware of any impact to customer data or production environments, but organizations that downloaded the affected Open VSX extensions on 3/23/2026 between 02:53 UTC and 15:41 UTC and ran them are potentially impacted.

Read the original at The Hacker News ↗

Topics: Cloud Security
Mentions: CVE-2026-33634
Related: CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability Known Exploited Vulnerabilities · Mar 26, 2026
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations Cyber Risks ·
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026