Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Developer environments using KICS data exposed after Checkmarx breach

Data Leak
First reported
Last updated
Happening score
H score 40
1 unique sources, 1 articles

Summary

Hide ▲

The compromised Checkmarx KICS toolchain was used to exfiltrate GitHub tokens, cloud credentials, and other secrets from developer environments, creating immediate account-takeover risk. The stolen data was encrypted and sent to audit.checkmarx[.]cx, with public GitHub repositories automatically created for exfiltration. The malicious DockerHub image was active during 2026-04-22 14:17:59 UTC to 2026-04-22 15:41:31 UTC. Anyone who pulled the tainted artifacts should assume secrets may be compromised and rotate credentials.

Related Happenings

GitHub hit by network compromise

Incident
H score42 First: 20.05.2026 07:01 Last: 20.05.2026 07:01 Sources 1

About this happening: GitHub is investigating unauthorized access to its internal repositories after a third party allegedly offered stolen material for sale on a cybercrime forum. The intrusion was li...

Latest development: 20.05.2026 13:45

GitHub detected unauthorized access tied to a poisoned Visual Studio Code (VS Code) extension on an employee device, removed the malicious extension version, isolated the endpoint, and began incident response to contain exposure across internal repositories.

Open Happening

CISA contractor GitHub repository exposed internal credentials

Data Leak
H score28 First: 18.05.2026 23:48 Last: 18.05.2026 23:48 Sources 1

About this happening: A CISA contractor left a public GitHub repository exposing AWS GovCloud credentials, plaintext passwords, and other internal access material tied to CISA and *...

Latest development: 10.07.2026 19:00

CISA said that within moments of receiving information about internal AWS GovCloud keys and other material in a public GitHub repository owned by a contractor, its Office of the Chief Information Officer took swift and comprehensive action to mitigate exposure to CISA cloud resources and code repositories. The agency said internal incident response began on May 15, no customer or mission data was exposed, and the leaked credentials were not used outside CISA's environments.

Open Happening

Mistral AI hit by network compromise

Incident
H score36 First: 15.05.2026 01:50 Last: 15.05.2026 01:50 Sources 1

About this happening: Mistral AI disclosed a codebase management system compromise tied to the Mini Shai-Hulud supply-chain attack, and the intrusion briefly contaminated some SDK packages....

Open Happening

Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials

Campaign
H score56 First: 12.05.2026 14:29 Last: 12.05.2026 14:29 Sources 1

About this happening: GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...

Open Happening

Rogue Checkmarx Jenkins AST plugin release on Jenkins Marketplace

Security Tool/Service
H score28 First: 12.05.2026 01:03 Last: 12.05.2026 01:03 Sources 1

About this happening: A rogue 2026.5.09 release of the Checkmarx Jenkins AST plugin was uploaded to repo.jenkins-ci.org, undermining trust in a security-scanning component used in Jenkins...

Open Happening

Timeline

  1. 23.04.2026 19:05 2 articles · 2mo ago

    Developer environments using KICS data exposed after Checkmarx breach

    Initial Disclosure

    The first visible phase was a trojanized checkmarx/kics Docker image on Docker Hub, later linked to compromised VSCode and Open VSX extensions. That initial delivery path mattered because it reached developer environments that routinely process sensitive infrastructure secrets.

    Show sources
    Open in new tab