A threat actor known as TeamPCP used credentials stolen in a prior Checkmarx breach to publish a malicious version of the official Checkmarx Jenkins AST Plugin (v2026.5.09) to the Jenkins Marketplace on May 9, 2026. Any organization that installed this version has had credential-stealing malware injected directly into their CI/CD pipeline, placing all pipeline secrets, tokens, and access keys at immediate risk of exfiltration. This is the third Checkmarx artifact compromised in a coordinated campaign spanning multiple months, enabled each time by Checkmarx’s failure to rotate credentials after the initial breach.