2026-03-23 · 2026-Q1
Checkmarx KICS GitHub Actions Compromise
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
Checkmarx KICS, AST GitHub Action, OpenVSX extensions
Impact
35 tags hijacked; credential stealer exfiltrated secrets encrypted to attacker server checkmarx.zone
Root Cause
cx-plugins-releases service account compromised via credentials from Trivy attack