GCVE-110-OSM-2026-1076

Legitimate Checkmarx KICS GitHub Action compromised on March 23, 2026 as part of the TeamPCP supply-chain campaign. Malicious code was active from 12:58 to 16:50 UTC before being removed approximately 3 hours after discovery. C2 communication to checkmarx.zone. Compromise was achieved using stolen CI/CD tokens obtained during the Trivy supply-chain attack (CVE-2026-33634). Compromised GitHub Action for Checkmarx KICS (Keeping Infrastructure as Code Secure). Compromise window: March 23, 2026, 12:58–16:50 UTC C2 domain: checkmarx.zone Malicious code removed ~3 hours after discovery. Compromise achieved via stolen tokens from Trivy supply-chain attack. Part of TeamPCP multi-ecosystem campaign.