LAPSUS$, using credentials stolen in a prior supply chain compromise of the open-source Trivy scanner, gained access to Checkmarx’s private GitHub repositories and published malicious Docker images and IDE extensions for the KICS infrastructure-as-code security scanner. Approximately 96GB of data was exfiltrated and published across dark web and clearnet extortion portals. Security and development teams that downloaded Checkmarx KICS artifacts recently, Docker images, VSCode extensions, or Open VSX extensions, may have introduced trojanized tooling directly into their build and development pipelines.