Credential-Stealing Malware Hits Popular Checkmarx Tools: A Supply Chain Crisis

Compromise of Checkmarx Tools

The malware attack specifically targeted Checkmarx’s KICS (Keeping Infrastructure as Code Secure) Docker images and VS Code extensions, both of which are highly popular in the development community. KICS is frequently used for scanning infrastructure-as-code files to detect vulnerabilities and misconfigurations, with the tool having been downloaded over five million times. Unfortunately, the attackers replaced existing versions of KICS with malicious versions while retaining the same version tags, such as v2.1.20 and the "latest" tag. This stealthy substitution meant that developers who trusted these containers unknowingly downloaded a compromised version, putting their systems at risk.

Additionally, Checkmarx’s VS Code extensions—Checkmarx Developer Assist and Checkmarx AST-Results—were also injected with malicious code. These extensions, which are designed to help developers scan code for security issues, now carry malware that targets sensitive developer credentials. The attackers embedded a multi-stage credential theft component, named "mcpAddon.js," which silently harvests various credentials and exfiltrates them to attacker-controlled servers. This breach not only affects the developers who used these tools, but also anyone who interacts with the compromised repositories and infrastructure, creating a ripple effect in the supply chain.

Mechanism of the Attack

The malware in KICS and VS Code extensions operates with a clear purpose: to capture and steal credentials. The KICS containers were modified to collect scan data, including sensitive configuration files laden with credentials. These scan reports are then encrypted and sent to external servers controlled by the attackers. As KICS is often used to scan Terraform, CloudFormation, and Kubernetes configurations, the data collected by this malware could include highly valuable credentials such as AWS, Microsoft Azure, and Google Cloud tokens.

Similarly, the compromised VS Code extensions leverage hardcoded GitHub links to download additional malicious JavaScript code without user consent. This code is responsible for stealing not only cloud and developer credentials but also various configuration files, environment variables, and tokens from multiple platforms. In addition to these direct compromises, the malware also abuses stolen GitHub tokens to inject malicious workflows into GitHub Actions, escalating the attack and allowing it to spread further across repositories and packages. Through this chain reaction, the attackers can use stolen credentials to push malicious code into victim repositories or packages, propagating the malware throughout the ecosystem.

The Role of TeamPCP in the Attack

The attackers behind this breach are suspected to be part of TeamPCP, a financially motivated hacking group that has been active since late 2025. TeamPCP has gained notoriety for targeting the open-source ecosystem, compromising popular tools and repositories to steal credentials and inject malicious code. The group is known for its broad attack strategy, which spans multiple platforms, including GitHub, npm, OpenVSX, and Docker Hub. This Checkmarx attack is part of a broader ongoing campaign by TeamPCP, which has already targeted several high-profile projects, including the Trivy security scanner and LiteLLM, a popular Python library.

The group's recent success in compromising Checkmarx tools is not an isolated incident. TeamPCP has been systematically exploiting weak points in the software supply chain, creating a snowball effect that compromises even more systems as stolen credentials are used to infiltrate additional services and repositories. The group's statement on social media, thanking OSS distribution for another successful day, reflects their growing confidence in executing these supply chain attacks.

The Impact on Developers

The compromised Checkmarx tools pose significant risks to organizations and developers. As the malware can harvest a wide range of credentials, including GitHub Auth tokens, AWS credentials, Azure tokens, and NPM configuration files, the potential for long-term damage is considerable. Developers and organizations that downloaded the affected KICS images or used the compromised VS Code extensions should treat this breach as a serious security incident. Credential exposure, combined with the potential for further supply chain compromise, demands immediate action.

Security experts recommend that affected parties rotate any exposed credentials and audit their cloud access logs for unusual activity. Additionally, developers should review their GitHub repositories for unauthorized changes, such as new workflow files or suspicious activity. NPM packages should be checked for unexpected updates or modifications, and cloud services should be carefully monitored for signs of compromised tokens or credentials.

Conclusion

This incident serves as a stark reminder of the vulnerabilities that persist in the software supply chain, particularly in the realm of open-source tools used by developers. The Checkmarx breach underscores the growing sophistication of cyberattacks, and the wide impact of supply chain attacks with consequences spreading to the bitwarden ecosystem. The implications of such breaches extend far beyond the immediate damage to the affected parties; they highlight the need for improved security practices in both the development community and the broader open-source ecosystem. With the ongoing threat from groups like TeamPCP, it’s clear that the software supply chain remains a critical battleground in the fight against cybercrime.