The attack on Trivy , Aqua Security ’s popular vulnerability scanning tool , has evolved into one of the most serious supply chain attacks of 2026, with attackers now distributing malware via Docker Hub and developing specialized destruction tools for Kubernetes clusters. According to cybersecurity researchers, new malicious versions of Trivy appeared on Docker Hub on March 22, while a new worm specifically targeting Iranian systems was also developed.
See also: Open VSX: Supply Chain attack distributes GlassWorm via compromised dev account
Socket researchers discovered that new versions of images tagged 0.69.5 and 0.69.6 were published to Docker Hub without corresponding versions on GitHub . “ Both images contain compromise indicators associated with the same TeamPCP infostealer observed in earlier stages of this campaign ,” said security researcher Philipp Burckhardt .
The initial attack on Trivy began in February 2026, when attackers exploited a misconfiguration in the GitHub Actions to extract a privileged access token. Despite a credential rotation performed by the Trivy on March 1, the process was not fully completed, allowing threat actors to maintain access using still valid credentials.
On March 19, at approximately 17:43:37 UTC, the attacker force-pushed 76 of the 77 version tags in the aquasecurity/trivy-action repository and all 7 tags in aquasecurity/setup-trivy . This action recursively infected the versions, redirecting trusted references to malicious commits. At the same time, the compromised aqua-bot service account enabled release automation to publish malicious binaries of Trivy version 0.69.4 .
See also: New malicious packages revealed in NuGet Supply Chain Attack
The attack has evolved beyond simple credential theft, with the attackers deploying a self-propagating worm known as CanisterWorm. The worm uses an Internet Computer Protocol (ICP) canister as a command-and-control infrastructure, supporting three methods: get_latest_link, http_request , and update_link, which allows the threat actor to modify behavior dynamically.
According to Socket , the CanisterWorm supply chain attack has expanded to 141 malicious package artifacts covering more than 66 unique packages . The attackers obtained one or more npm publishing tokens or equivalent CI/CD publishing access , then replaced the legitimate contents of the packages with malicious code and republished it in additional packages.
A new payload attributed to TeamPCP has been found to go beyond credential theft, destroying entire Kubernetes clusters located in Iran. The shell script uses the same ICP canister associated with CanisterWorm and then performs checks to identify Iranian systems. “ In Kubernetes: deploys privileged DaemonSets on every node, including the control plane ,” said Aikido security researcher Charlie Eriksen . “ Iranian nodes are destroyed and forcefully rebooted via a container named ‘kamikaze’. Non-Iranian nodes get the CanisterWorm backdoor installed as a systemd service .”
According to the OpenSourceMalware team , the attackers have tampered with all 44 internal repositories associated with Aqua Security ’s GitHub organization “ aquasec-com ”, renaming each with the prefix “ tpcp-docs- “, setting all descriptions to “ TeamPCP Owns Aqua Security ”, and exposing them publicly. All repositories were modified in a 2-minute scripted burst between 20:31:07 UTC and 20:32:26 UTC on March 22, 2026.
See also: GlassWorm attack: Stolen GitHub tokens used to insert malware into Python repos
This development is the latest escalation from a threat actor that has built a reputation for targeting cloud infrastructure, while progressively building capabilities to systematically expose Docker APIs, Kubernetes clusters, Ray dashboards , and Redis servers for data theft, ransomware, extortion, and cryptocurrency mining.
