Full Report
Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace. [...]
Analysis Summary
# Incident Report: Supply Chain Compromise of Checkmarx Jenkins AST Plugin
## Executive Summary
In May 2026, the threat group "TeamPCP" published a rogue version of the Checkmarx Jenkins Application Security Testing (AST) plugin to the Jenkins Marketplace. The attack was a continuation of a series of supply chain compromises enabled by stolen GitHub credentials that Checkmarx failed to rotate following a previous breach. The rogue plugin contained credential-stealing malware, potentially impacting CI/CD pipelines and developer environments globally.
## Incident Details
- **Discovery Date:** May 9, 2026
- **Incident Date:** May 9, 2026 (Part of a campaign active since late March 2026)
- **Affected Organization:** Checkmarx
- **Sector:** Cybersecurity / Software Development Tools
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Late March 2026
- **Vector:** Credential Theft / Supply Chain Pivot
- **Details:** TeamPCP obtained GitHub repository credentials during a prior supply-chain attack on the "Trivy" vulnerability scanner.
### Lateral Movement
- **Details:** Using the stolen credentials, the attackers gained unauthorized access to Checkmarx’s GitHub environment. They remained undetected for over a month, moving across repositories to target various developer tools.
### Data Exfiltration/Impact
- **Details:** Attackers injected malicious code into multiple artifacts, including the KICS analysis tool (Docker/VSCode) and finally the Jenkins AST plugin. The code was designed to harvest credentials and data from developer environments.
### Detection & Response
- **How it was discovered:** Detection of an irregular plugin version (2026.5.09) on repo.jenkins-ci.org that bypassed the official release pipeline and lacked standard metadata (Git tags/GitHub release).
- **Response actions taken:** Checkmarx alerted users to the rogue version, began publishing a clean replacement, and advised immediate secret rotation.
## Attack Methodology
- **Initial Access:** Valid Accounts (Stolen GitHub credentials from the Trivy breach).
- **Persistence:** Continued access to GitHub repositories due to a failure to rotate secrets/tokens.
- **Defense Evasion:** Leveraging official distribution channels (Jenkins Marketplace, Docker Hub, Open VSX) to distribute malware via "trusted" updates.
- **Credential Access:** The rogue plugin functioned as an infostealer to harvest environment variables and CI/CD secrets.
- **Exfiltration:** Malicious artifacts harvested and sent developer environment data to attacker-controlled infrastructure.
- **Impact:** Supply Chain Compromise; deployment of rogue software to automated CI/CD pipelines.
## Impact Assessment
- **Financial:** Not disclosed; costs associated with incident response and customer support.
- **Data Breach:** Compromise of developer-level credentials and secrets used within Jenkins pipelines.
- **Operational:** Disruption of CI/CD workflows for customers using the AST plugin; requirement for manual remediation.
- **Reputational:** High; this was the third supply chain incident for the firm in a short period, mocked publicly by the attackers ("Checkmarx fails to rotate secrets again").
## Indicators of Compromise
- **File indicators:**
- Rogue Jenkins Plugin Version: `2026.5.09`
- Legitimate Version (Safe): `2.0.13-829.vc72453fa_1c16` (or older)
- **Behavioral indicators:**
- Updates published outside of the standard release window.
- Plugins lacking associated Git tags or GitHub release documentation.
- Unexpected outbound traffic from Jenkins nodes to unknown external endpoints.
## Response Actions
- **Containment:** Removal/Deprecation of the rogue plugin version from the Jenkins Marketplace.
- **Eradication:** Checkmarx began the process of publishing a verified new version of the plugin.
- **Recovery:** Communications sent to customers via the Support Portal and Security Updates blog.
## Lessons Learned
- **Credential Hygiene:** Failure to rotate secrets following a known compromise (Trivy incident) allowed the attacker to maintain long-term access.
- **Pipeline Integrity:** The ability for an attacker to bypass the official release pipeline and publish directly to the marketplace indicates a need for stricter enforcement of CI/CD signing and gatekeeping.
## Recommendations
- **Rotate All Secrets:** All customers who downloaded the rogue version must rotate all credentials stored in or accessible by Jenkins.
- **Implement MFA:** Ensure all repository and marketplace accounts require hardware-based Multi-Factor Authentication.
- **Automated Secret Rotation:** Move toward short-lived, automated token rotation for GitHub Actions and other CI/CD integrations.
- **Integrity Verification:** Organizations should implement checksum or signature verification for all third-party plugins before deployment in production pipelines.