Glowing lock icons broken by VoidStealer and Trivy scanner infostealer.

Daily Cybersecurity News - March 22, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 22, 2026 3:22 PM 2 min read

Trivy Scanner Breach Delivers Infostealer

Executive Summary

The popular Trivy vulnerability scanner was compromised in a sophisticated supply chain attack. Threat actors injected credential-stealing malware into official GitHub Actions, distributing the payload to thousands of CI/CD pipelines that rely on the tool for security scanning.

Attack Overview

Attack Path: Attackers used a compromised Personal Access Token (PAT) from a previous incident to gain access. They then force-pushed malicious code to 75 of 76 existing version tags in the `trivy-action` repository, hijacking the update mechanism.
Attacker: TeamPCP

Impact Assessment

Data Stolen: The malware was designed to harvest sensitive data from CI/CD environments, including SSH keys, cloud credentials (AWS, GCP, Azure), and Kubernetes tokens by dumping runner process memory.

Detection & Hunting

IOCs: Monitor for network connections to `scan.aquasecurtiy[.]org` and IP `45.148.10[.]212`. Search for the creation of a public GitHub repository named `tpcp-docs`, a fallback exfiltration method.

Strategic Takeaway

This incident highlights the critical risk of mutable infrastructure tags and incomplete credential rotation, turning a trusted security tool into a widespread malware distribution vector.

Relevant professional terms

Supply Chain Attack: An attack strategy that targets less-secure elements in a software supply network, such as third-party libraries or build tools, to compromise a final product.
Infostealer: A type of malware designed specifically to collect and exfiltrate sensitive information, such as login credentials, financial data, and system information, from a victim's computer.

Source: BleepingComputer

VoidStealer Bypasses Chrome Encryption

Executive Summary

The VoidStealer information stealer targets Chromium-based browsers, aiming to decrypt and steal sensitive user data. It employs a novel technique to bypass Google's Application-Bound Encryption (ABE) to extract the master decryption key directly from memory.

Key TTPs

Execution: Spawns a hidden and suspended browser process to attach to it.
Defense Evasion: Attaches to the browser as a debugger and uses hardware breakpoints to read the master key from memory, avoiding the need for privilege escalation or code injection.

Campaign Analysis

VoidStealer is the first malware observed in the wild to adopt this stealthy, debugger-based bypass technique. This marks a significant evolution in credential theft, as the method has a lower detection footprint compared to traditional injection-based approaches.

Targeting & Infrastructure

Target Profile: Users of Chromium-based browsers such as Google Chrome and Microsoft Edge.
Infrastructure: Offered as a Malware-as-a-Service (MaaS) on darkweb forums since late 2025.

Relevant Terms

Information Stealer: Malware designed to collect sensitive data from a victim's computer, such as login credentials, browser data, and cryptocurrency wallets.
Hardware Breakpoint: A debugging feature that stops execution when a specific memory location is accessed, allowing malware to read data without modifying the target application's code.

Source: BleepingComputer