Lapsus$ and ShinyHunters Turn Security Vendors Into Backdoors

Two Security Tools, Two Threat Actors, Same Pattern

The actor is Lapsus$. The victim is Checkmarx. The mechanism is a compromised GitHub account used to publish malicious payloads inside KICS (Keeping Infrastructure as Code Secure), a vulnerability scanner that runs inside CI/CD pipelines with deep network and credential access. Initial compromise: March 2026. Second payload: week of April 21. Data leak: April 26–27. Downstream, the Vect ransomware group is collaborating with TeamPCP against organizations already compromised through the KICS and Trivy supply chain.

Vect's encryption is broken by design: files larger than 128KB are permanently destroyed, not encrypted. Paying the ransom does not recover that data.

Parallel campaign, different actor. ShinyHunters breached Anodot, a cloud-cost monitoring platform, and is running a methodical customer-by-customer extortion campaign. Anodot's product requires API access to cloud data platforms to analyze cost patterns. ShinyHunters is walking that legitimate access path into customer Snowflake instances. Confirmed victims: Vimeo, Rockstar Games, Zara, Payoneer.

Why This Pattern Keeps Working

The logic has not changed since SolarWinds in 2020 and Codecov in 2021. Security and observability tools run with credentials the attacker would otherwise have to steal. KICS reads source code. Source code contains secrets that should not be in source. An attacker who owns the scanner owns what the scanner sees. Anodot needs query access to the data warehouses it monitors. The pivot is the product.

Cross-Source Intelligence

Publicly: ShinyHunters is running at scale this cycle, confirmed across multiple sources. Reported but not confirmed: 9M Medtronic records, removed from the leak site after April 21, which is suggestive of payment, and 8.2M Pitney Bowes emails. A Scattered Spider member was arrested in Helsinki. Operational tempo has not slowed.

The Vect/TeamPCP collaboration stacks a destructive ransomware layer on top of the initial supply-chain compromise. Lapsus$ provides initial access. Vect/TeamPCP monetizes through encryption that destroys anything over 128KB. Checkmarx's disclosure is unlikely to cover every payload.

Two Injection Techniques, Same Build Environment

Disclosed by Egor Kovetskiy: a GitHub .patch URL injection that turns commit messages into executable diffs. GitHub's .patch export embeds the full commit message inline with the diff. Downstream tooling treats a commit message containing valid diff syntax as a legitimate change. GNU patch will write to .git/hooks/post-applypatch. The next git am runs attacker code silently. No on-screen warning. GitHub's UI never shows the smuggled files.

Blast radius: mirroring bots, AI code-review agents, patch-importing CI steps, and any automation that fetches commit.patch from untrusted forks.

elementary-data PyPI Package: 12-Hour Credential Exfiltration

The elementary-data package ships 1.1 million downloads a month. A weaponized v0.23.3 was live for roughly 12 hours. Delivery vehicle: a GitHub Actions script-injection flaw. The malicious version exfiltrated warehouse credentials, cloud keys, API tokens, SSH keys, and .env contents. Detection marker: the 'trinny' marker file. Fix is v0.23.4.

Twelve hours at 1.1 million monthly downloads is enough. Anyone who ran an unpinned install during that window should rotate, not audit.

The Structural Problem: GitHub Actions Insecure by Default

Multiple sources converge on the same finding: GitHub has publicly declined to change the insecure defaults that enable these attacks, citing backward compatibility. The platform lacks three primitives that define a trustworthy package manager: lockfiles, integrity hashes, and transitive dependency visibility. Every incident in the last 18 months exploited mutable tags, over-scoped GITHUB_TOKENs, or pull_request_target on untrusted forks. The tj-actions/changed-files compromise pulled secrets from an estimated 23,000+ repositories.

Sources disagree on the full downstream count. Publicly, one source cites 23,000 repos. Not publicly, incident-response circles put the compromised-secrets population higher, with several downstream breaches still being worked. Treat the second sentence as unverified until it is not. The vendor has told customers that compensating controls are their problem.

The Pairing Is the Technique

The two techniques pair naturally in a campaign. Stage 1: a malicious pull request whose .patch representation carries executable content when fetched by an automated CI/CD job. Stage 2: a dependency pulled from PyPI that has been poisoned upstream. The result is RCE inside the build environment, which holds secrets, tokens, and signing keys. No SBOM review would have caught either.