Unknown threat actors compromised Checkmarx’s official Docker Hub repository and VS Code Extension distribution channel, embedding credential-stealing malware in KICS versions used to scan Infrastructure as Code files. Any organization running KICS in CI/CD pipelines with these affected versions should assume cloud credentials, API keys, and infrastructure secrets captured during scans have been exfiltrated to an attacker-controlled endpoint. The business risk is immediate and severe: exposed credentials provide direct access to cloud environments, enabling data theft, ransomware deployment, or full infrastructure takeover.