Tag: teampcp cloud stealer

2 Attack Reports | 0 Vulnerabilities

Attack reports

Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions

A threat actor known as TeamPCP expanded its supply chain attack from Aqua Security's Trivy to Checkmarx's AST GitHub Action. The attack, which began on March 19, 2026, involved injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The malicious code harvest…

supply chain attack

teampcp cloud stealer

ci/cd compromise

Published: March 24, 2026

Downloadable IOCs: 0

Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets

A new supply chain attack targeting Trivy has compromised 75 out of 76 version tags in the aquasecurity/trivy-action GitHub repository. The attacker force-pushed these tags to serve malicious payloads, effectively turning trusted version references into a distribution mechanism for an infostealer. …

credential theft

supply chain attack

teampcp cloud stealer

Published: March 20, 2026

Downloadable IOCs: 2

Click here to see more Attack Reports