New Checkmarx supply-chain breach affects KICS analysis tool

Hackers compromised Docker images, VSCode and Open VSX extensions for the Checkmarx KICS analysis tool. The compromise included a hidden 'MCP addon' feature that downloaded multi-stage credential theft malware (mcpAddon.js) from a hardcoded GitHub URL. The malware targets GitHub tokens, cloud credentials (AWS, Azure, Google Cloud), npm tokens, SSH keys, Claude configs, and environment variables. It encrypts and exfiltrates data to audit.checkmarx[.]cx domain and automatically creates public GitHub repositories for data exfiltration. Docker tags were temporarily repointed to malicious digest during a specific timeframe.