Technical March 31, 2026
When Trusted Security Tools Turn Against You: The TeamPCP Campaign and Why Runtime Protection Is No Longer Optional
In March 2026, the threat actor TeamPCP compromised Trivy, KICS, and LiteLLM — turning trusted security tools into credential stealers across thousands of CI/CD pipelines. We break down how the attacks cascaded, why traditional defenses failed, and how tailored AppArmor profiles enforce runtime protection that stops compromised components regardless of how they were infected.
By Hannes Ullman
Read more
