Supply Chain Attack - KICS GitHub Action Compromised

What Happened

On March 23, 2026, the KICS GitHub Action, a security scanner developed by Checkmarx, fell victim to a credential-stealing malware attack orchestrated by the group known as TeamPCP. This incident occurred between 12:58 and 16:50 UTC, during which 35 tags were compromised. Users who had pinned their workflows to these tags unknowingly executed the malicious code. The repository was taken down shortly after a user reported the issue to the maintainers. However, it was reinstated later that day with the maintainers claiming the problem was resolved.

This attack marks the second time in a week that TeamPCP has targeted a widely used open-source security scanner. The group employed similar tactics to those used in the recent Trivy incident, indicating a pattern in their approach to supply chain attacks.

Who's Being Targeted

The KICS GitHub Action is an open-source tool designed for Infrastructure as Code security scanning. While it has a smaller user base compared to Trivy, its adoption in both public and private sectors makes it a significant target. Users who rely on KICS for security assessments could be at risk, particularly those who used the compromised tags in their workflows. The attack could potentially expose sensitive data and credentials from affected repositories.

Tactics & Techniques

The attack was executed through a compromised service account, specifically the cx-plugins-releases account, which was responsible for publishing the malicious tags. TeamPCP staged imposter commits on a fork of the KICS repository, embedding their payload. They then updated the tags to point to these malicious commits. The malware introduced several new features, including a new command-and-control (C2) domain and a fallback mechanism that creates a repository named docs-tpcp using the victim's GITHUB_TOKENs. This allows the attackers to maintain persistence even if their primary C2 is disrupted.

Defensive Measures

To mitigate the risks associated with this incident, security teams should take immediate action. First, they should audit their GitHub Actions workflows that reference the kics-github-action. If any versions of the action were used during the exposure window, teams should check their workflow run logs for signs of compromise. Additionally, organizations should search for any repositories named docs-tpcp, as these may indicate successful exfiltration of data. For ongoing guidance, users are encouraged to monitor advisories from security firms like Wiz and implement best practices for securing GitHub Actions.