Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

Back Thehackernews

Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

Thehackernews •[email protected] (The Hacker News) • April 22, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Targets Checkmarx KICS Tool via Docker and VSCode Extensions Hackers have compromised Docker images and VSCode extensions for the Checkmarx KICS analysis tool, which is used to identify security vulnerabilities in source code. The attack involved a trojanized KICS Docker image that was available on the official Docker Hub repository between April 22, 2026, 14:17:59 UTC and April 22, 2026, 15:41:31 UTC. The malicious images included a hidden 'MCP addon' feature that downloaded credential-stealing malware. This malware targets sensitive data processed by KICS, such as GitHub tokens and cloud credentials, encrypting and exfiltrating them to a domain designed to impersonate Checkmarx. Developers who downloaded the compromised images are advised to rotate their secrets and rebuild their environments. The attack has been linked to the TeamPCP hackers, although attribution remains uncertain. Checkmarx has removed the malicious artifacts and is investigating the incident with external experts. 2 sources 74

Extracted Entities

Attack Types (1)

Supply Chain Attack

Companies (1)

Tools (1)