Loading malware…
Trivy is Aqua Security’s legitimate open-source vulnerability scanner; the malicious activity associated with this name concerns trojanized releases and compromised GitHub Actions distributed during a March 2026 software supply-chain attack attributed to TeamPCP. The attack affected the scanner, its scanning and installation actions, and official binary and container distribution channels. It targeted CI/CD runners, software build infrastructure, and developer machines rather than a specific industry.
On March 19, 2026, attackers used access retained after an incompletely contained earlier compromise to replace numerous GitHub Action version tags and publish a malicious Trivy 0.69.4 release. Additional malicious container images labeled 0.69.5 and 0.69.6 appeared on March 22. The compromised actions and binaries executed credential-stealing code when invoked through otherwise trusted development workflows. The trojanized binary ran legitimate scanning functionality alongside its malicious code.
The payload harvested environment variables and filesystem secrets, including SSH and TLS private keys, cloud credentials, Kubernetes tokens, registry credentials, package-publishing tokens, database configuration, Terraform data, and cryptocurrency wallet files. It also read GitHub Actions runner process memory to recover workflow secrets. Collected data was compressed and encrypted using AES-256-CBC with an RSA-OAEP-protected session key, then transmitted to attacker-controlled infrastructure. If direct exfiltration failed, it could use stolen GitHub credentials to create a public repository in the victim’s account and upload the encrypted data as a release asset.
On non-CI Linux developer systems, the malicious binary attempted to establish persistence through a Python backdoor registered as a systemd user service, which polled for follow-on payloads. Stolen CI/CD credentials enabled further supply-chain compromises, including malicious LiteLLM package releases.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco's source-code theft was linked to "a compromised development environment running a poisoned Trivy container."
On March 19, 2026, aquasecurity/trivy-action — a widely used GitHub Action for running the Trivy vulnerability scanner — was compromised for approximately 12 hours... a malicious trivy binary release (v0.69.4) was published for approximately 3 hours.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
ERA Security Scanner ... nmap, nikto, subfinder, subdomain enumeration, IP reputation, DNS, and mail security analysis ... security-tools-mcp ... nmap, nuclei, sqlmap, nikto, dirsearch, httpx, trivy ... NmapService nmapScan
The v0.69.4 binaries contained malicious code that phones home to a typosquat C2 domain... scan[.]aquasecurtiy[.]org — note the typo ( securtiy vs security ), a typosquat of Aqua Security's domain.
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
two malicious versions of LiteLLM were published directly to PyPI... LiteLLM's PyPI publishing token was exposed through a poisoned Trivy binary running inside CI. The token was then used to upload weaponized packages without ever touching LiteLLM's source code or release workflow.
Late February — Attackers compromise Trivy, a widely-used open-source vulnerability scanning tool, planting malicious code within it. Early-to-Mid March — LiteLLM's CI/CD pipeline runs the compromised version of Trivy.
Besides the Trivy breach, TeamPCP has been linked to ransomware attacks and crypto-mining campaigns... The hackers have more recently been behind a systematic campaign of supply chain attacks compromising other open source security projects...
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise). ownCloud confirms: no customer data compromised, no source code altered, impact limited to build systems only.
By abusing valid credentials and trusted CI/CD workflows, attackers are bypassing traditional security controls, enabling widespread access across build systems, cloud infrastructure, and customer environments.
access AWS environments, execute commands in containers... The attackers validated cloud keys... and used them to access cloud services, enumerate infrastructure, run commands inside containers...
Using compromised credentials with tag write access, the attacker force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy, redirecting existing, trusted version references to malicious commits.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
The poisoned Trivy binary ran inside the GitHub Actions runner and scraped process memory via /proc/<pid>/mem, bypassing GitHub's secret masking to extract the PYPI_PUBLISH_PASSWORD token in plaintext.
The report attributes the initial compromise to a vulnerability in Trivy, exploited through a GitHub Action workflow using pull_request_target and related Trivy automation.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
The poisoned Trivy binary ran inside the GitHub Actions runner and scraped process memory via /proc/<pid>/mem, bypassing GitHub's secret masking to extract the PYPI_PUBLISH_PASSWORD token in plaintext.
After exfiltration, the malware cleaned up all temporary files and launched the legitimate Trivy scan.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
Cosign ensures authenticity. 🔹 Kyverno/Gatekeeper blocks anything unsigned or unsafe from entering Kubernetes.
Using compromised credentials with tag write access, the attacker force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy, redirecting existing, trusted version references to malicious commits.
It iterated through th e /proc/ directory to isolate the PIDs for the .NET runtime powering the Runner.Worker process. Because the script inherited the runner’s user privileges, it read the /proc/<pid>/mem file descriptor , mapped the memory boundaries via /proc/<pid>/maps, and ran string-matching algorithms across the heap memory segments.
LiteLLM's CI/CD pipeline used a compromised version of the Trivy security scanner, leading to the exposure of PyPI publishing credentials... Attackers use the stolen credentials to upload two backdoored LiteLLM releases.
The attacker's script can easily read any of them with an environment lookup like os.environ.get('MY_SECRET') and send them back to an attacker without leaving evidence.
threat actors used the Trufflehog open source tool to find and validate stolen credentials. Then, TeamPCP performed reconnaissance ... After the organization downloaded a compromised version of Trivy, attackers stole an AWS API key ... From there, they used Trufflehog to discover more AWS credentials
The poisoned Trivy binary ran inside the GitHub Actions runner and scraped process memory via /proc/<pid>/mem, bypassing GitHub's secret masking to extract the PYPI_PUBLISH_PASSWORD token in plaintext.
...use that access to pivot to obtain data stored in the Commission’s AWS account.
using credentials stolen during earlier compromises to access Amazon Web Services (AWS) accounts, execute commands in containers... Reviewing cloud logs for unexpected Amazon Elastic Container Service Exec activity...
researchers observed worm-like propagation techniques leveraging exposed SSH keys, insecure Docker and Kubernetes APIs, and compromised npm packages to spread across connected systems.
deleted trusted tags, and force-pushed malicious binaries beginning with Trivy v0.69.4, along with poisoned GitHub Actions... These artifacts contained an infostealer...
with the Trivy compromise, TeamPCP has effectively turned one of the most widely used vulnerability scanners into an infostealer inside CI pipelines.
before finally accessing various resources, such as S3 buckets and Amazon Elastic Container Service (ECS) instances, to exfiltrate sensitive data ... and then exfiltrated data from the environment
HTTPS POST to C2: Stolen data is encrypted (SHA-256 + base64), then sent to an attacker-controlled domain decoded at runtime via the scramble cipher.
ICP blockchain node used as primary C2 — first confirmed blockchain-hosted C2 in a supply chain attack
The trivy release automation ( aqua-bot ) published v0.69.4 ... The v0.69.4 binaries contained malicious code that phones home to a typosquat C2 domain.
The stolen data was then encrypted ... and bundled into a tpcp.tar.gz archive, then exfiltrated via HTTP POST to the typosquatted domain scan.aquasecurtiy[.]org.
Fallback exfiltration — if the C2 is unreachable and a GitHub PAT is available, creates a public repository called tpcp-docs on the victim's GitHub account and uploads the stolen data as a release asset.
Encrypted credential bundle uploaded as release asset to attacker-created tpcp-docs GitHub repo
execute commands in containers, and exfiltrate sensitive cloud data... Reviewing cloud logs for unexpected Amazon Simple Storage Service access, and Secrets Manager retrievals.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.