Trend MicroPublished
Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft
Excerpt
By By: Jacob Santos, John Rainier Navato May 13, 2026 Read time: 17 min (4541 words) Summary
Our research analyzed the April 22 Checkmarx Keeping Infrastructure as Code Secure (KICS) and April 24 elementary-data incidents as two case studies within a broader TeamPCP supply chain campaign spanning at least seven confirmed waves. KICS showed multichannel poisoning across Docker Hub, VS Code/OpenVSX, and GitHub Actions, followed by a downstream hijack of @bitwarden/cli using stolen npm tokens. elementary-data used GitHub Actions script…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Trend Micro on trendmicro.com.
Mentioned in the excerpt
More from Trend Micro18
- Lemon Group’s Cybercriminal Businesses Built on Preinfected DevicesTrend Micro · Published 17 May 2023
- Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures RevealedTrend Micro · Added 14 Oct
- Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux ImplantTrend Micro · Added 2 Sep
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel IndustryTrend Micro · Published 29 Jun
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
