The threat actor TeamPCP, after compromising Aqua Security's Trivy GitHub Action on March 19, 2026, used stolen CI/CD credentials to poison a second unrelated GitHub Action — Checkmarx's ast-github-action v2.3.28 — approximately four days later. The attack follows an identical kill chain: scraping secrets from Runner.Worker process memory, harvesting AWS IMDS credentials, enumerating Slack/Discord webhooks, and exfiltrating an AES-256+RSA-4096 encrypted archive to vendor-specific typosquat domains. The cascading nature of the attack — one poisoned action harvesting tokens that enable poisoning of additional actions — highlights the fragility of tag-based action references. Runtime detection via Falco and Sysdig Secure proved effective because the underlying syscall behavior is identical regardless of which action delivers the payload. Recommendations include pinning actions to commit SHAs, rotating all exposed credentials, restricting IMDS access, and enabling runtime monitoring on CI runner infrastructure.
