Cisco Source Code Stolen in Trivy Supply-Chain Breach, BleepingComputer Reports

On March 31, 2026, BleepingComputer reported - citing a source close to the matter - that Cisco's internal build and development environment had been breached using credentials stolen in the recent Trivy supply-chain compromise. According to the reporting, a malicious GitHub Action plugin from the Trivy attack harvested credentials and data from Cisco's environment, impacting dozens of devices including some developer and lab workstations. Attackers cloned more than 300 GitHub repositories and used stolen AWS keys to perform unauthorized activity across a small number of Cisco AWS accounts. Importantly, Cisco has not issued a public statement confirming these details; the account rests on BleepingComputer's sourcing, later corroborated by other outlets and consistent with Aqua Security's disclosure of the Trivy compromise.

Trivy is Aqua Security's widely used open-source vulnerability scanner, embedded in CI/CD pipelines where it runs with access to build secrets. On March 19, 2026, the threat group TeamPCP - tracked by Google's Threat Intelligence Group as UNC6780 - force-pushed malicious code to 76 of 77 version tags in the aquasecurity/trivy-action GitHub Action and all tags in aquasecurity/setup-trivy, and published a malicious Trivy binary (v0.69.4) to official distribution channels. Any pipeline that ran the poisoned action produced normal-looking scan output while the group's infostealer - named SANDCLOCK by GTIG - harvested environment variables, cloud tokens, SSH keys, and AWS credentials in the background. The incident was assigned CVE-2026-33634 with a CVSS of 9.4. When Cisco's pipelines executed the compromised action, the stealer captured the credentials used to reach its internal infrastructure.

Per BleepingComputer, the cloned repositories include source code for Cisco's AI Assistant and AI Defense products, along with other repositories - some reportedly belonging to Cisco customers such as banks, business process outsourcing firms, and US government agencies. The theft of AI-product source code is strategically sensitive: access to the logic behind a threat-detection product can help adversaries study how it works and craft evasions. The stolen AWS keys added a cloud dimension, enabling unauthorized activity in a limited set of Cisco accounts before credentials were rotated. Reporting notes multiple threat actors may have been active in the environment with varying degrees of involvement.

Any organization that ran Trivy, trivy-action, or setup-trivy (or the malicious binary) in CI/CD between roughly March 19 and March 27, 2026 should treat all credentials accessible to those pipelines as compromised. Update to fixed versions - Trivy v0.69.2+, trivy-action v0.35.0, setup-trivy v0.2.6 - and rotate AWS keys, SSH keys, GitHub tokens, Kubernetes secrets, and any other pipeline secrets. As durable hardening, pin GitHub Actions to specific commit SHAs rather than movable version tags (the attack abused tag mutability), prefer OIDC over long-lived cloud keys, and apply least privilege to CI/CD jobs. Cisco customers or partners with code or build artifacts in Cisco's infrastructure should contact Cisco to determine whether their repositories were affected.

Separately from the substantiated dev-environment breach, the extortion group ShinyHunters published a post on March 31 with an April 3 deadline, alleging theft of 3 million or more Salesforce records, additional GitHub repositories, and AWS S3 data. As of that reporting, the public evidence consisted of screenshots (some showing Cisco AWS resources), and no dataset had been released - so these broader claims are unverified and should be treated as a claim of access rather than confirmed scope. The Cisco breach is one node in a broader TeamPCP/UNC6780 campaign that also hit Checkmarx (KICS/AST Actions), LiteLLM (PyPI), and the Telnyx SDK. Watch for any official Cisco statement, further ShinyHunters disclosures, and downstream exposure for customers whose repositories were among those cloned.