Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

Malicious threat actors compromised the official Checkmarx KICS Docker repository, modifying existing tags and introducing a new version with data exfiltration capabilities.

• •Attackers overwrote tags v2.1.20, alpine, and introduced v2.1.21, enabling unauthorized access to infrastructure-as-code scans
• •Modified KICS binary generates encrypted scan reports and exfiltrates them to external endpoints
• •Related Checkmarx tools, including VS Code extensions (versions 1.17.0 and 1.19.0), contained malicious code to download and execute remote addons via Bun runtime without user verification
• •Teams using affected KICS versions should treat exposed secrets and credentials as compromised
• •Evidence suggests a broader supply chain compromise affecting multiple Checkmarx distribution channels