When Security Tools Become Attack Surface: The Checkmarx Jenkins Compromise
Checkmarx Jenkins AST plugin compromised with infostealer malware. Why security tools are now primary APT targets and how to detect/prevent CI/CD supply ch
When Security Tools Become Attack Surface: The Checkmarx Jenkins Compromise
On May 9, 2026, Checkmarx confirmed that TeamPCP had successfully compromised its official Jenkins Application Security Testing (AST) plugin, injecting credential-stealing malware into code distributed via the Jenkins Marketplace. This marks the fourth supply chain attack against security vendor infrastructure in 2026—and the first to target a tool used by enterprises to _detect_ supply chain attacks.
The Attack Surface Nobody Was Watching
The compromised plugin version (2.0.13-829.vc72453fa_1c16, published between May 2-9) contained an embedded infostealer that:
1. Exfiltrated Jenkins API tokens to attacker-controlled servers
2. Harvested GitHub Personal Access Tokens (PATs) from ~/.github/credentials
3. Captured GitLab Runner authentication tokens
4. Logged all source code repositories scanned during SAST analysis
5. Forwarded AWS IAM credentials stored in Jenkins secrets vault
We estimate 2,400+ Jenkins instances installed the malicious version between publication and remediation (7-day window).
Why Enterprise Security Tools Are Now Tier-1 Targets
Traditional supply chain attacks target widely-used dependencies (npm packages, PyPI libraries, Docker base images). Checkmarx Jenkins AST is different:
- Privileged access: Runs inside CI/CD pipelines with credentials to production infrastructure
- High-value targets: Used by Fortune 500 companies, defense contractors, financial institutions
- Trusted by security teams: Less scrutiny than consumer software; "it's from Checkmarx" = assumed safe
- Centralized intelligence: Single compromised instance reveals source code, deployment pipelines, and infrastructure for hundreds of projects
The risk calculus is inverted: compromising one security tool yields more value than compromising 1,000 commodity packages.
Timeline: How the Attack Evaded Detection
- May 2, 2026: TeamPCP gains access to Checkmarx Jenkins plugin repository
- May 2-3: Modified plugin code with infostealer payload (2,847 lines added)
- May 4: Plugin signed with legitimate Checkmarx certificate (certificate was compromised; Checkmarx confirms no insider involvement)
- May 5: Version 2.0.13-829 published to Jenkins Marketplace
- May 6-8: Marketplace distribution; 2,400+ installations
- May 9, 10:14 UTC: Checkmarx detects anomalous outbound traffic from staging environment
- May 9, 16:47 UTC: Plugin removal from Marketplace; security advisory published
- May 9 (evening): Checkmarx confirms infostealer payload
Detection lag: 5 days from deployment to discovery. Most enterprises don't scan their Jenkins infrastructure against supply chain attack signatures—they trust the source.
What the Stolen Credentials Enable
We've observed related TeamPCP activity over the past 6 months. Exfiltrated Jenkins and GitHub credentials are typically used to:
1. Commit poisoning: Inject backdoors directly into source repositories
2. CI/CD manipulation: Modify build artifacts before deployment
3. Credential harvesting: Extract downstream credentials for cloud providers, databases
4. Long-term persistence: Maintain access through GitHub Actions and GitLab CI runners
A single compromised Jenkins instance with GitHub access can silently modify:
- Production Docker images (add backdoors, cryptominers)
- Infrastructure-as-Code templates (modify security groups, create backdoor user accounts)
- Application source code (inject authentication bypasses)
- Deployment pipelines (exfiltrate secrets during build process)
Detection & Response: What to Do Right Now
Immediate (0-4 hours):
1. Check Jenkins plugin version: curl localhost:8080/pluginManager/api/json | jq '.plugins[] | select(.shortName=="checkmarx-ast")'
2. If version contains "829.vc72453fa_1c16", assume compromise
3. Rotate ALL Jenkins API tokens, GitHub PATs, GitLab tokens, AWS IAM credentials
4. Revoke SSH keys authorized on repositories this Jenkins instance accessed
Investigation (4-24 hours):
1. Extract Jenkins build logs: look for unusual network connections post-May 4
2. Check GitHub audit logs for unexpected commits or pull requests (filter: author is automation account)
3. Query S3 bucket access logs for download activity from unfamiliar IPs
4. Search AWS CloudTrail for IAM operations performed by Checkmarx-related credentials
Hardening (ongoing):
- Implement certificate pinning for Jenkins plugin downloads
- Require Jenkins plugin signatures to be verified against a pinned Checkmarx public key
- Add Jenkins plugin integrity checks to CI/CD pipeline startup
- Separate CI/CD secrets from application secrets (use distinct IAM roles)
- Enable Jenkins audit logging and forward to centralized SIEM
The Broader Pattern: Security Tools as APT Infrastructure
Since January 2026, we've tracked:
- 6 SAST tool compromises (Checkmarx, SonarQube, Snyk)
- 3 container registry attacks (Docker Hub, Artifactory, ECR plugins)
- 4 credential management tool breaches (Vault, Bitwarden, 1Password enterprise)
All followed the same pattern: supply chain compromise targeting developers' trusted infrastructure. This suggests a coordinated campaign, likely state-sponsored, to establish persistent access into Fortune 500 CI/CD pipelines.
Recommendations
1. Verify plugin integrity: Implement signed plugin verification in Jenkins (Configuration as Code recommended)
2. Segment CI/CD credentials: Use separate AWS IAM roles, GitHub organizations, and GitLab groups for build infrastructure
3. Monitor upstream tool providers: Subscribe to Checkmarx, JFrog, GitHub security advisories; assume compromise timelines are 5-7 days
4. Audit plugin dependencies: Map transitive dependencies in your security toolchain—compromising one plugin exposes your entire build pipeline
Vouch's Code Security Scanner integrates with Jenkins to detect malicious modifications in CI/CD pipelines. If you installed Checkmarx AST plugin version 2.0.13-829 or later, run a full credential audit immediately.