When a company gets hacked, the first thing security teams reach for is their scanning tools. The software that checks code for vulnerabilities before it goes live. The automated systems that run in the background, quietly making sure nothing dangerous slips through.
A hacking group just turned those exact tools into the attack.
Over the past week, a group calling itself TeamPCP compromised two of the most widely used security scanning tools in the software development ecosystem. First, on March 19, they hijacked Aqua Security’s Trivy scanner, a tool referenced by more than 10,000 projects on GitHub. Then on March 23, they hit Checkmarx’s KICS, another widely trusted security tool. In both cases, the attackers replaced the legitimate code with a three-stage information stealer that quietly harvested passwords, cloud credentials, encryption keys, and access tokens from every company running those tools.
The part that makes this particularly uncomfortable: everything looked normal. The security scans still ran. The dashboards still showed green. The only difference was that before the scan completed, the malware had already copied everything it needed and sent it to the attackers. Mandiant’s CTO Charles Carmakal confirmed that over 1,000 cloud environments have been infected so far.
Here’s how it started. Back in February, a separate breach gave TeamPCP access to credentials belonging to Aqua Security. Aqua responded by resetting some passwords. But not all of them. That gap, one incomplete credential rotation, gave TeamPCP a way back in weeks later. Once inside the Trivy project, they rewrote 75 of the tool’s 76 version tags to point to their malicious code. Any company that updated or reinstalled Trivy after March 19 pulled down the compromised version automatically.
The stolen credentials from Trivy then gave the attackers access to Checkmarx’s tools. One breach became two. Two became a cascade. TeamPCP also published poisoned extensions for Visual Studio Code, the code editor used by millions of developers worldwide, and launched a self-spreading worm through npm, the package manager that supplies building blocks for a massive portion of the internet’s software. CrowdStrike’s analysis confirmed the worm spread to at least 47 additional software packages, with the number still climbing.
Buried in the technical details is something that reads more like a geopolitical statement than a cybercrime operation. The worm contains a targeted payload specifically designed to destroy computer systems located in Iran. It identifies Iranian infrastructure, mounts the core operating system, deletes everything, and forces a reboot. The motivation behind that is unclear, but it means this operation has dimensions beyond simple theft.
This is the third major attack on GitHub’s automated tooling system in the past year. In March 2025, a similar hijacking of the tj-actions project affected 23,000 repositories. The playbook is the same each time. Attackers rewrite the version tags that developers trust, so when someone’s system automatically pulls the latest update, it gets the malicious version instead. The fix is known: pin your tools to specific, verified versions instead of letting them auto-update. Most teams don’t do this because it adds friction to their workflow. So the same attack keeps working.
The guardrails simply aren’t there anymore. The systems that developers built to protect software are themselves unprotected. The assumption that your security tools are safe because they’re security tools is exactly the assumption being exploited. Every company running automated code scanning, which is most of them, now has to ask a question that shouldn’t need asking: can I trust the thing I’m trusting to keep me safe?
What This Means for Everyday People
You’ve never heard of Trivy or Checkmarx or GitHub Actions. But they’re part of the invisible machinery behind the apps on your phone, the sites you shop on, and the systems your bank uses. When the tools that check those systems for problems get hijacked, the problems stop being caught. And the attackers who did this now have passwords and access credentials for over a thousand companies. That translates, eventually, to breaches that reach your inbox, your accounts, and your data.