When Security Scanners Become the Weapon: Breaking Down the Trivy Supply Chain Attack

On March 19, 2026, the cybersecurity community found that a tool used to protect the software supply chain could become the attack vector.

Aqua Security’s Trivy, one of the most widely used open-source vulnerability scanners, was compromised in a multi-phase supply chain attack. The breach exposed CI/CD secrets, planted persistent backdoors on developer machines, and spread a self-propagating worm across dozens of npm packages.

Trusted security tooling became a credential-harvesting weapon, enabling a cascading breach across environments.

In this blog we will break down how the attack unfolded, place it in the broader supply chain threat landscape, and show how Cortex Cloud delivers the layered protection needed to detect, prevent, and respond to attacks like this.

We should also highlight that this Trivy Supply Chain Attack appears to have been a root from which additional attacks are emerging in the last few days and we believe that we are not completely over this attack campaign.

What Happened?

Two incidents, one root cause. The March 19 attack did not appear out of nowhere. Three weeks earlier, an autonomous bot called hackerbot-claw exploited a misconfigured pull_request_target workflow in Trivy’s GitHub Actions to steal a Personal Access Token (PAT).

Aqua Security discovered the breach and rotated credentials, but the rotation was not complete. The attackers, a group identifying as TeamPCP (also tracked as DeadCatx3, PCPcat, ShellForce, and CipherForce), retained access to the credentials that survived.

Incomplete containment is a recurring issue in incident response. When breaches are not fully addressed, they create the conditions for the next attack.

The Five-Phase Attack Chain

Phase 1: Credential Reuse and Repository Takeover
Using credentials from the first incident, TeamPCP compromised the aqua-bot service account and made impersonated commits, spoofing legitimate maintainer identities. They pushed a malicious v0.69.4 tag to the Trivy repository (github.com/aquasecurity/trivy), triggering an automated release pipeline that distributed backdoored binaries to GitHub Releases, Docker Hub, GHCR, and Amazon ECR.

Phase 2: GitHub Actions Tag Poisoning
The attackers force-pushed 75 out of 76 version tags in aquasecurity/trivy-action to point to malicious commits. Any GitHub Actions workflow referencing a version tag like @v0.28.0 automatically ran attacker-controlled code at runtime, without changing the workflow file. The malicious commits reused original author metadata and timestamps, creating a deceptive appearance in Git history. Seven setup-trivy tags were also poisoned.

Phase 3: Three-Step Credential Theft
The poisoned actions executed a three-step attack:

• Collection: The malware read directly from GitHub Actions Runner memory (/proc/<pid>/mem), bypassing log-masking. It harvested SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes tokens, Docker registry credentials, database passwords, TLS private keys, and cryptocurrency wallet files.
• Encryption: Stolen data was encrypted with AES-256-CBC and wrapped with RSA-4096, rendering network-layer inspection ineffective.
• Exfiltration: Data was sent to a typosquatted domain (scan.aquasecurtiy[.]org). As a fallback, the malware used the victim’s GitHub PAT to create a public repository named tpcp-docs and staged the data there, leveraging trusted infrastructure for exfiltration.

Phase 4: Persistent Backdoor on Developer Machines

When the malicious Trivy binary ran on a developer workstation, it deployed a systemd service (sysmon.py) that polled an Internet Computer (ICP) blockchain canister every 50 minutes for command-and-control instructions. This decentralized C2 infrastructure is resistant to takedown.

Phase 5: CanisterWorm — Self-Propagating npm Supply Chain Attack

Using stolen credentials, TeamPCP launched CanisterWorm which compromised 47+ npm packages across multiple scopes. Later variants added token theft and malicious publishing in the postinstall hook, making every developer or CI pipeline that installed an affected package an unwitting propagation vector. Twenty-eight packages were compromised in under 60 seconds

A Pattern, Not an Anomaly: The Supply Chain Threat Landscape

The Trivy attack is part of a clear escalation pattern in supply chain attacks:

• SolarWinds (2020): Compromised build system injected backdoors into signed updates distributed to 18,000 organizations.
• Codecov (2021): Attackers modified a bash uploader script to exfiltrate CI/CD environment variables.
• ua-parser-js (2021): Hijacked npm package with 8M weekly downloads to distribute cryptominers.
• tj-actions/changed-files (2025): GitHub Action compromised to steal CI/CD secrets via tag poisoning — the same technique used against Trivy.
• Trivy (2026): Combined credential theft, tag poisoning, binary tampering, persistent backdoors, and a self-propagating worm — the most sophisticated supply chain attack on a security tool to date.

The trend is clear: attackers are moving upstream, targeting the tools and infrastructure developers trust. Security scanners, CI/CD actions, and package managers are high-value targets because they run with elevated privileges and are rarely scrutinized at runtime.

Immediate Actions for Security Teams

If your organization uses Trivy, take these steps now:

1. Verify safe versions: trivy v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6
2. Pin all GitHub Actions to full SHA hashes — not version tags
3. Search for tpcp-docs repositories in your GitHub organization (indicates successful exfiltration)
4. Block scan.aquasecurtiy[.]org and 45.148.10.212 at the network level
5. Check developer machines for sysmon.py or pgmon systemd services
6. Rotate all secrets that were accessible from affected CI/CD runners
7. Use npm ci with --ignore-scripts in CI pipelines to prevent postinstall hook execution

How Cortex Cloud Can Help

The Defense-in-Depth Advantage

No single security control can stop a sophisticated supply chain attack. The Trivy breach shows why defense-in-depth is essential, with integrated visibility across code, build, deploy, and runtime.

Cortex Cloud delivers a unified security platform that covers every phase of this attack across Software Supply Chain Security, AppSec, Cloud Workload Protection, and Extended Detection and Response.

This includes out-of-the-box Supply Chain Security rules that assure your development floor and pipelines are configured according to security best practices and that your workstations and networks are behaving and communicating as they should and no abnormal activity is recognized.

Below you can find a more detailed analysis of Cortex ability to detect and block every phase of the described attack:

Software Supply Chain and Application Security

Cortex Cloud’s Supply Chain Security continuously monitors CI/CD configurations, pipeline definitions, and repository settings for misconfigurations that create attack surfaces.

Poisoned Pipeline Execution Detection
The initial credential theft exploited a pull_request_target misconfiguration, a well-known Poisoned Pipeline Execution (PPE) vector. Cortex Cloud’s CI/CD risk engine detects this pattern and alerts security teams before it can be exploited. Its out-of-the-box CI/CD security rules cover direct PPE attacks, command injection in user events, and workflows that bypass required reviews.

Unpinned GitHub Actions Detection
Tag poisoning, the core delivery mechanism of the attack, would have been neutralized if downstream users pinned GitHub Actions to full SHA hashes instead of mutable version tags. Cortex Cloud flags unpinned actions as a CI/CD risk, and prevention policies can block pipelines referencing tag-based actions. This single control would have stopped the attack from reaching any Cortex Cloud-protected pipeline.

Credential Hygiene Enforcement
Cortex Cloud detects unrotated secrets, excessive repository permissions, overly permissive workflow token scopes, and organization secrets not scoped to specific repositories. Each of these conditions contributed to the Trivy breach and can be prevented with supply chain security rules.

SCA Package Integrity
Cortex Cloud’s Software Composition Analysis (SCA) detects malicious packages, typosquatting, dependency confusion, and tampered releases. Against CanisterWorm, which published malicious npm packages, Cortex SCA can recognize and block (or alert) pipelines that install malicious packages and can recognize those malwares even if they propagate to registries or to runtime environments.

Secrets Detection with Active Validation
The attack relied on npm tokens in .npmrc files and environment variables. Cortex Cloud AppSec detects exposed credentials (secrets) and validates whether they are still active, enabling teams to rotate compromised tokens before they are weaponized.

Endpoint and Network Analytics

Endpoint Persistence Detection and Response

The malicious Trivy binary deployed a persistent systemd service (sysmon.py) on developer workstations, masquerading as PostgreSQL tooling. Organizations with endpoint runtime protection deployed on developer machines would detect this unauthorized service creation, flag the anomalous process tree (a vulnerability scanner spawning a Python systemd service), and block execution of unsigned binaries fetched from the internet. In Cortex Cloud, this is provided by the Cortex XDR agent.

Network Threat Detection and Domain Reputation Analysis

The encrypted exfiltration to a typosquatted domain (scan.aquasecurtiy[.]org), periodic beaconing to an ICP blockchain canister, and fallback exfiltration via GitHub all represent detectable network anomalies. Network analytics can detect beaconing patterns and connections to newly registered or typosquatted domains, while DNS security and advanced URL filtering can block connections to known-malicious and suspicious domains at the network layer. In Cortex Cloud, these capabilities are provided by Cortex XSIAM network analytics, DNS Security, and Advanced URL Filtering.

Beaconing Detection
The persistent backdoor polled the ICP canister every 50 minutes. Cortex XDR behavioral analytics detects periodic outbound connections to unusual endpoints, even with low-volume, long-interval traffic.

Typosquatted Domain Detection
Exfiltration used scan.aquasecurtiy[.]org, a typosquat of aquasecurity.org. Cortex XSIAM flags connections to newly registered or visually similar domains.

Endpoint Behavioral Analytics
On developer machines, Cortex XDR detects the full attack chain: new systemd service creation by a non-standard parent process, periodic blockchain connections, and download-and-execute behavior from dynamic URLs.

Strengthen Your Defenses: Lessons from the Trivy Attack

The Trivy supply chain attack is an important moment for DevSecOps. It reminds us that security tools are high-value targets, mutable references like version tags create systemic vulnerabilities, and static analysis alone cannot detect attacks operating at application and network layers.

Cortex Cloud’s integrated platform delivers layered defense across the full spectrum of supply chain attacks. From CI/CD misconfiguration detection to runtime behavioral threat detection and anomaly detection, every phase of the Trivy attack maps to a Cortex Cloud capability that detects or blocks it.

The question is no longer if security tools will be targeted. It’s when. Organizations that survive will have defense-in-depth visibility from code to cloud to endpoint.

Learn More

Request a demo to discover how Cortex Cloud can protect your software supply chain.

Indicators of Compromise