TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

TeamPCP, the threat actor behind the Trivy supply chain attack, has compromised two Checkmarx GitHub Actions workflows using credentials stolen from the earlier breach.

• •The affected workflows are checkmarx/ast-github-action and checkmarx/kics-github-action, both maintained by supply chain security company Checkmarx.
• •The "TeamPCP Cloud stealer" targets SSH keys, Git, AWS, Google Cloud, Azure, Kubernetes, Docker, .env files, databases, VPNs, CI/CD configs, crypto wallets, and Slack/Discord webhooks.
• •Attackers force-push tags to malicious commits containing a payload (setup.sh) that exfiltrates encrypted data to checkmarx[.]zone using typosquat domains to evade detection in CI/CD logs.
• •A fallback mechanism creates a "docs-tpcp" repository using the victim's GITHUB_TOKEN to stage stolen data if the primary exfiltration fails.