How Stolen CI Credentials Led to Another Major Supply Chain Breach—And How to Prevent It

In early 2026, the cybersecurity world was rocked once again as the threat actor known as TeamPCP infiltrated two of Checkmarx’s GitHub Actions workflows—checkmarx/ast-github-action and checkmarx/kics-github-action. These workflows are critical components in many organizations’ software supply chains, designed to detect security flaws during development. The irony? A security company’s tools were exploited to potentially compromise the very systems they’re meant to protect.

The intrusion was made possible through stolen CI (Continuous Integration) credentials, allowing the attackers to inject malicious code into legitimate workflows. This isn’t just a breach of trust—it’s a wake-up call for every organization relying on automated pipelines. With TeamPCP previously linked to the Trivy supply chain attack, this latest incident confirms a troubling pattern: attackers are no longer targeting end applications—they’re going straight for the development infrastructure.

How the Attack Unfolded

According to reports, TeamPCP gained access to Checkmarx’s CI environment by compromising long-lived API tokens and service account credentials. These credentials were used to authenticate automated workflows in GitHub Actions, granting the attackers the ability to modify, deploy, and execute code under the guise of legitimacy.

Once inside, the hackers altered the GitHub Action workflows to include malicious payloads—likely designed to exfiltrate secrets, harvest credentials, or deploy backdoors into downstream projects. Because these workflows are trusted and widely used, any project integrating them could unknowingly run compromised code, turning a single breach into a cascading supply chain attack.

What makes this particularly dangerous is the trust model inherent in CI/CD systems. Developers assume that a workflow published by a reputable security vendor—like Checkmarx—is safe. But when the credentials to that workflow are compromised, the entire chain of trust collapses.

The Broader Threat: CI/CD as the New Attack Surface

Modern software development relies heavily on automation. From code testing to deployment, CI/CD pipelines are the backbone of agile development. But with convenience comes risk. Each integration point, each third-party action, each stored credential is a potential entry point for attackers.

TeamPCP’s strategy is simple but effective: target the weakest link in the CI/CD chain—often human error or poor credential hygiene. Long-lived tokens, unrotated secrets, and excessive permissions create a treasure trove for attackers. Once inside, they can move laterally, escalate privileges, and embed themselves deep within the infrastructure.

This isn’t an isolated issue. In the past two years, we’ve seen a surge in CI/CD-based attacks:

• The Codecov breach in 2021, where a compromised bash uploader exfiltrated customer environment variables.
• The Trivy incident linked to TeamPCP, where a malicious update to a popular vulnerability scanner opened backdoors in thousands of systems.
• Multiple npm and PyPI package hijackings where attackers gained access to maintainer accounts and pushed trojanized versions.

Each case follows the same playbook: compromise credentials, inject malicious code into trusted tools, and let automation do the rest.

Why Traditional Security Falls Short

Many organizations still rely on perimeter-based security models—firewalls, endpoint protection, and network segmentation. While important, these measures do little to protect against insider threats or compromised credentials within CI/CD environments.

Secrets stored in environment variables, hardcoded API keys, and misconfigured access controls are common in development pipelines. Often, these are treated as “temporary” or “internal,” so they’re not rotated, audited, or encrypted appropriately. Attackers know this—and exploit it ruthlessly.

Additionally, the speed of modern development often outpaces security review. Pull requests are merged quickly, automated tests are trusted implicitly, and workflows execute without human oversight. This velocity, while beneficial for innovation, creates blind spots that malicious actors are eager to exploit.

Building Resilience: Best Practices for Secure CI/CD

So how can organizations protect themselves? The answer lies in a layered approach that combines technical controls, policy enforcement, and secure collaboration practices.

• Rotate credentials frequently: Avoid long-lived tokens. Use short-lived, scoped credentials with automatic rotation. Tools like HashiCorp Vault or AWS Secrets Manager can help automate this process.
• Enforce least privilege: CI/CD workflows should only have the minimum permissions required to function. Avoid using admin tokens or broad access keys.
• Sign and verify artifacts: Use cryptographic signing (e.g., Sigstore) to ensure that only authenticated code is executed. Verify signatures before running any third-party action.
• Audit and monitor: Continuously monitor CI/CD logs for anomalies. Set up alerts for suspicious activities like unauthorized changes to workflows or unexpected network calls.
• Isolate sensitive operations: Keep workflows that handle secrets or deploy to production separate from general development workflows. Use dedicated runners with restricted network access.

The Role of Secure File Sharing in Development Workflows

One often-overlooked aspect of CI/CD security is how teams share sensitive files—configuration files, certificates, encryption keys, or audit reports. Too often, these are sent via email, Slack, or consumer-grade cloud storage, exposing them to interception or unauthorized access.

This is where secure file sharing becomes essential. At FileShot.io, we believe that every file shared during development should be protected with the same rigor as production data. That’s why FileShot uses end-to-end encryption so your files can’t be accessed—even by our servers. Once uploaded, files are encrypted client-side, and only recipients with the correct link and passphrase can decrypt them.

Unlike traditional platforms, FileShot doesn’t store decryption keys. Files expire automatically, and download attempts are logged for audit purposes. This ensures that sensitive CI/CD artifacts—like deployment scripts or environment configs—are never left exposed.

Imagine a developer needing to share a temporary database dump with a teammate. Instead of attaching it to an email or uploading it to an unsecured drive, they use FileShot. The file is encrypted before it leaves their machine, remains encrypted in transit and at rest, and disappears after it’s been downloaded. Even if an attacker intercepts the link, they can’t access the content without the passphrase—separately shared via a secure channel.

Conclusion: Trust, but Verify—Especially in CI/CD

The Checkmarx incident is a stark reminder that trust in automation must be balanced with verification. Just because a tool comes from a reputable source doesn’t mean it’s immune to compromise. As attackers grow more sophisticated, so must our defenses.

Securing CI/CD pipelines isn’t just about scanning code or locking down repositories—it’s about protecting every link in the chain, from credentials to collaboration tools. By adopting zero-trust principles, automating secrets management, and using secure file sharing platforms like FileShot, development teams can build resilience into their workflows.

The future of software security depends on it. Because in a world where even security tools can be weaponized, the only safe assumption is that everything must be protected—by design.

Sorry, we couldn't load this post. Please go back to the blog index.