Loading malware…
Trivy is an open-source vulnerability scanner whose official distribution channels were compromised in March 2026 as part of a TeamPCP supply-chain attack. Malicious Trivy releases, including v0.69.4 and later backdoored container-only images, were published through trusted release infrastructure and paired with compromised GitHub Actions components such as trivy-action and setup-trivy. The trojanized artifacts preserved normal scanning behavior while covertly executing credential-harvesting logic, making the compromise difficult to detect in CI/CD pipelines and developer environments.
The malicious Trivy payload focused on theft of secrets from GitHub-hosted and self-hosted runners. It performed process discovery and memory scraping against GitHub Actions runner processes to recover masked secrets, enumerated numerous filesystem locations for cloud credentials, SSH material, Kubernetes tokens, Docker credentials, database secrets, environment files, package-manager tokens, TLS material, shell history, and other sensitive data, then packaged and encrypted the collected information for exfiltration. Reported exfiltration included direct network transmission and a fallback mechanism that abused GitHub repository and release functionality using stolen tokens. On non-CI Linux developer systems, the backdoored binary also attempted persistence by installing a user-level systemd-backed Python backdoor for follow-on payload retrieval.
The compromise is attributed to TeamPCP, also tracked under aliases including DeadCatx3, PCPcat, Persy_PCP, ShellForce, and CipherForce. The operation exploited retained access after an earlier credential theft involving a misconfigured GitHub Actions workflow and incomplete credential rotation. The campaign extended beyond Aqua Security into downstream victims whose pipelines consumed poisoned Trivy artifacts, enabling theft of CI/CD secrets later used to compromise additional ecosystems including npm, PyPI, OpenVSX, Docker registries, and other software supply-chain targets. Organizations affected included security vendors and downstream software producers, with build systems and release pipelines particularly exposed.
This incident is associated with CVE-2026-33634 and is notable as a high-impact example of trusted security tooling being weaponized for credential theft and broader supply-chain propagation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Backdoored Trivy binaries v0.69.4, v0.69.5, and v0.69.6 were published to Docker Hub, GHCR, and ECR.
On March 19, 2026, aquasecurity/trivy-action — a widely used GitHub Action for running the Trivy vulnerability scanner — was compromised for approximately 12 hours... a malicious trivy binary release (v0.69.4) was published for approximately 3 hours.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
research from Novee Security was released, reporting a CI/CD weakness that could enable anyone with an unauthenticated free GitHub account to hijack trusted workflows and compromise open-source supply chains.
when TeamPCP poisoned Trivy’s repository cache, any pipeline that installed Trivy without a pinned version downloaded and executed the attacker’s binary.
Besides the Trivy breach, TeamPCP has been linked to ransomware attacks and crypto-mining campaigns... The hackers have more recently been behind a systematic campaign of supply chain attacks compromising other open source security projects...
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise). ownCloud confirms: no customer data compromised, no source code altered, impact limited to build systems only.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
After exfiltration, the malware cleaned up all temporary files and launched the legitimate Trivy scan.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
It iterated through th e /proc/ directory to isolate the PIDs for the .NET runtime powering the Runner.Worker process. Because the script inherited the runner’s user privileges, it read the /proc/<pid>/mem file descriptor , mapped the memory boundaries via /proc/<pid>/maps, and ran string-matching algorithms across the heap memory segments.
When the compromised action ran, it harvested LiteLLM’s PyPI publishing token.
The attacker's script can easily read any of them with an environment lookup like os.environ.get('MY_SECRET') and send them back to an attacker without leaving evidence.
threat actors used the Trufflehog open source tool to find and validate stolen credentials. Then, TeamPCP performed reconnaissance ... After the organization downloaded a compromised version of Trivy, attackers stole an AWS API key ... From there, they used Trufflehog to discover more AWS credentials
CERT-EU said that the breach originated on March 19 when hackers acquired a secret API key associated with the European Commission’s AWS account... allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
CERT-EU said the credentials seemed to have been harvested through the Trivy supply-chain attack.
A security scanner whose compromise impacted downstream build infrastructure in the TeamPCP supply chain campaign.
Referenced as the compromised component in a supply chain incident affecting downstream build infrastructure, tied to CVE-2026-33634.
A legitimate open-source vulnerability scanner that was backdoored in this supply-chain campaign to harvest CI/CD secrets from affected pipelines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.