Cloud Security Breach - TeamPCP Hacks Checkmarx Workflows

What Happened

In a concerning breach, the threat actor known as TeamPCP has compromised two GitHub Actions workflows maintained by Checkmarx. These workflows, namely checkmarx/ast-github-action and checkmarx/kics-github-action, were infiltrated using stolen CI credentials. This incident follows TeamPCP's earlier attack on the Trivy vulnerability scanner, suggesting a pattern of escalating cyber threats.

The attack was first observed on March 19, 2026, and was linked to a credential-stealing malware that targets various cloud services and CI/CD configurations. Security firm Sysdig reported that the same malware was used in both attacks, highlighting the increasing sophistication of TeamPCP's operations.

Who's Affected

The primary victims of this breach are organizations using Checkmarx's GitHub Actions workflows. These workflows are integral to securing supply chains and ensuring the integrity of software development processes. If attackers gain access to sensitive credentials, they can potentially compromise not just Checkmarx but also any associated repositories and services linked to the stolen credentials.

The implications of this breach extend beyond Checkmarx, as any organization utilizing these compromised workflows may face significant risks. The cascading effect of such a breach can lead to further supply chain compromises, affecting numerous stakeholders in the software development ecosystem.

What Data Was Exposed

The TeamPCP Cloud stealer is designed to harvest a wide range of sensitive data, including:

• SSH keys
• GitHub personal access tokens (PATs)
• Cloud service credentials (AWS, Google Cloud, Azure)
• Kubernetes and Docker configurations
• Secrets from CI/CD environments

The attackers exfiltrate the stolen data to a domain named checkmarx[.]zone, where it is stored in an encrypted archive. The malware's ability to force-push malicious commits into trusted actions significantly complicates detection and remediation efforts, as it masquerades as legitimate activity.

What You Should Do

To mitigate the risks associated with this breach, organizations should take immediate action:

• Rotate all secrets and tokens that were accessible during the affected period.
• Audit GitHub Actions workflow runs for any references to suspicious domains or files.
• Search for repositories named tpcp-docs or docs-tpcp, indicating successful exfiltration.
• Pin GitHub Actions to specific commit SHAs to prevent unauthorized changes.
• Monitor outbound connections from CI runners to detect suspicious activity.

By implementing these measures, organizations can better protect themselves against potential cascading supply chain attacks stemming from this breach. The evolving tactics of TeamPCP underscore the need for robust security practices in cloud environments.