TeamPCP Targets Checkmarx Jenkins Plugin After KICS Breach

A coordinated supply-chain attack attributed to TeamPCP compromised the Trivy scanner and then pushed a malicious Checkmarx Jenkins AST plugin update (2026.5.09) that silently harvested CI/CD environment variables and cloud credentials; stolen data was later published by LAPSUS$. The report includes IOCs (filenames and SHA-256 hashes) and urges immediate scanning, removal, and blocking of malicious domains.