Cyber & Information Warfare — 2026-04-27

Lapsus$ and TeamPCP Compromise Checkmarx Security Scanner in Widening Supply Chain Attack

Socket disclosed that actors compromised the official checkmarx/kics Docker Hub repository on April 22, overwriting image tags with a malicious KICS binary that collected and exfiltrated cloud credentials, GitHub tokens, and SSH keys to an attacker-controlled domain impersonating Checkmarx infrastructure. Four VS Code extensions were simultaneously trojanized via a backdated commit injecting a credential stealer also engineered to propagate through CI/CD pipelines and republish packages across the npm ecosystem. TeamPCP publicly claimed credit on X after the incident became public; BleepingComputer reported the evidence supported only pattern-based correlation, not confident attribution. A Privacy Guides community post separately indicates the Bitwarden CLI npm package was compromised in the same attack chain.

Analysis
TeamPCP's April operation marks the second confirmed Checkmarx compromise in five weeks. The expansion from GitHub Actions workflows to Docker Hub tag overwrites and VS Code extension distribution channels shows the group methodically widening its footprint within the Checkmarx toolchain rather than pivoting to new targets. The targeting logic is deliberate: security teams running KICS scans on their own infrastructure were delivering cloud credentials (GitHub, AWS, Azure, GCP, Claude) to attacker-controlled repositories while believing they were hardening their posture. Checkmarx's inability to determine whether April's intrusion reflects retained access, re-compromise, or unremediated March credentials is the most consequential disclosure. Organizations that ran affected tools between March and April should treat all exposed credentials as compromised. Whether additional Checkmarx products or broader customer data exposure surfaces within 60 days is genuinely uncertain, contingent on the scope of attacker write access Checkmarx has not yet fully mapped.

3 sources

Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain - The Hacker News
New Checkmarx supply-chain breach affects KICS analysis tool - BleepingComputer
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain - discuss.privacyguides.net