Checkmarx KICS GitHub Action Reportedly Compromised Through Malicious Release Tags
Summary
A now-unavailable GitHub advisory reportedly said malware was injected into all Checkmarx KICS Action release tags. The post describes credential and runner-memory targeting; the repository is back online, but the reported claims are not independently confirmed here.
Key points
- The article says a March 23, 2026 advisory claimed all release tags in the Checkmarx KICS GitHub Action repository were compromised; the master branch reportedly appeared clean.
- Workflows using version-tag references such as @v2.1.7, @v1.7.0, or @latest allegedly ran attacker-controlled code in setup.sh.
- The original advisory reportedly described targeting AWS, Azure, and GCP credentials, SSH keys, Kubernetes service account tokens, and CI/CD runner process memory.
- The payload allegedly encrypted and exfiltrated stolen data to checkmarx[.]zone and attempted persistence through a systemd backdoor and privileged Kubernetes pods.
- The GitHub issue and repository were initially unavailable; the article later updated that the repository was back online. It says the investigation is ongoing, and provides no independent confirmation of the claims.
- The article recommends disabling version-tag references, treating accessible workflow secrets as potentially compromised, and pinning to a verified full commit SHA once the action is safe.
Article Details
- Victim Organization
- Checkmarx
- Incident Type
- Reported supply-chain compromise of the Checkmarx KICS GitHub Action, with malicious infostealer code injected into release tags.
- Disclosure Date
- 2026-03-23
- Data Types Exposed
- AWS, Azure, and GCP credentials
- SSH keys
- Kubernetes service account tokens
- CI/CD runner process memory
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Workflows using affected release tags reportedly executed attacker-controlled code. The payload reportedly targeted credentials, dumped CI/CD runner process memory, exfiltrated encrypted data, and attempted persistence through a systemd backdoor and privileged Kubernetes pods. Actual data theft and persistence are not independently confirmed in the article.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- alleged
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Reported attacker-controlled domain used to receive encrypted exfiltrated data. |
MITRE ATT&CK
T1003.007 · Proc FilesystemThe payload reportedly dumped CI/CD runner process memory by reading /proc/<pid>/mem.T1543.002 · Systemd ServiceThe payload reportedly attempted persistence through a systemd backdoor.T1610 · Deploy ContainerThe payload reportedly attempted to deploy privileged Kubernetes pods where cluster credentials were available.
People
Vendors
Products
GitHub ActionsThis attack follows the same tag-poisoning pattern seen in recent GitHub Actions supply chain compromises, including the Trivy GitHub Actions compromise last week.KICSOn March 23, 2026, a critical security advisory was filed reporting that all Git tags in the Checkmarx/kics-github-action repository have been compromised with a malicious infostealer injected into setup.sh. The master