Published: March 22, 2026

A fresh software supply-chain incident is putting developer teams on alert: attackers reportedly compromised the popular Trivy vulnerability scanner and used that access to push credential-stealing malware through official releases and GitHub Actions tags. For businesses that rely on CI/CD automation, this is the kind of threat that can quietly turn a trusted security tool into an entry point for broader compromise.

What happened

According to reporting from BleepingComputer, threat actors linked to TeamPCP tampered with Trivy’s build and release workflow. The attackers allegedly used compromised repository credentials to publish a malicious Trivy v0.69.4 release and redirect numerous aquasecurity/trivy-action tags to harmful commits.

Aqua Security also acknowledged the incident in a public GitHub discussion, stating that the attack was tied to an earlier March breach whose containment was incomplete.

Why this threat matters

This incident is especially serious because Trivy is a security product that many engineering and DevOps teams trust inside build pipelines. When a tool like that is compromised, the blast radius can extend beyond a single workstation.

• Developer endpoints may leak credentials, environment variables, and local secrets.
• CI/CD runners may expose cloud keys, deployment tokens, Kubernetes secrets, and repository credentials.
• Trusted automation paths can become malware delivery channels without triggering the same suspicion as a random executable.

In short: this is not just a bad download problem. It is a supply-chain trust problem.

What the malware reportedly tried to steal

Public analyses cited by BleepingComputer indicate the malicious payload looked for a wide range of sensitive artifacts, including:

• SSH keys and shell history files
• AWS, Azure, and GCP credentials
• Kubernetes and Docker configuration files
• .env files and database credentials
• Git, package manager, and CI/CD tokens
• TLS private keys, webhook tokens, and other infrastructure secrets

Researchers also reported persistence behavior on Linux systems through a user-level systemd service, which means the compromise may not end with the initial execution.

Who is at risk

• You downloaded or executed Trivy v0.69.4
• You used aquasecurity/trivy-action or related setup actions during the affected window
• You rely on GitHub Actions workflows that automatically pull moving tags rather than pinned commit SHAs
• You run build pipelines that have access to production credentials, cloud environments, or container registries

What QuickMSP recommends right now

1. Identify exposure immediately. Review recent CI/CD runs, developer machines, and container build systems for Trivy use during the incident period.
2. Rotate secrets aggressively. Replace cloud credentials, SSH keys, API tokens, package registry tokens, webhook secrets, and database passwords that may have been accessible.
3. Inspect GitHub Actions workflows. Check whether affected Trivy actions were referenced by tag and review logs for suspicious outbound activity.
4. Look for persistence. On Linux systems, investigate unusual user-level systemd services and files under ~/.config/systemd/user/.
5. Hunt for exfiltration indicators. Review DNS, proxy, and egress logs for suspicious connections tied to the reported campaign.
6. Pin and verify dependencies. Prefer immutable commit SHAs for GitHub Actions and apply stronger signing, provenance, and release verification controls.

Executive takeaway

The Trivy compromise is a reminder that modern cyber risk increasingly sits inside the software delivery chain. Even trusted security tools can become attack vehicles when build infrastructure or release credentials are breached. For MSPs and internal IT teams, the lesson is blunt: security tooling must be monitored with the same skepticism as every other third-party dependency.

If your organization uses GitHub Actions, developer workstations, cloud automation, or containerized pipelines, now is a good time to validate dependency trust, tighten token scopes, and reduce how many secrets your pipelines can access by default.

Sources

• BleepingComputer: Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
• Aqua Security GitHub discussion on the March 19, 2026 incident

A newly reported campaign tracked by Microsoft as Storm-2561 is targeting employees who search online for enterprise VPN software. Instead of landing on a legitimate vendor page, victims are being redirected to convincing fake download sites that imitate trusted brands such as Ivanti, Cisco, and Fortinet. The downloaded installer looks legitimate, but it is designed to steal VPN usernames, passwords, and configuration data.Why this threat mattersThis is a serious business risk because VPN credentials often provide a direct route into internal systems. If an attacker captures valid remote access credentials, they may be able to bypass perimeter defenses, move laterally, and gain access to sensitive files, cloud applications, and administrative tools.Microsoft says the campaign uses search engine optimization (SEO) poisoning to push malicious sites higher in search results. That means the victim does not need to click a phishing email. Simply searching for a VPN client download can be enough to trigger the attack.How the attack worksAccording to Microsoft, the attack chain follows a simple but effective pattern:- A user searches for a VPN client such as Pulse Secure or Fortinet.- The search results lead to a spoofed website that looks like the real vendor.- The fake site delivers a ZIP file containing a malicious installer.- The installer drops malware that mimics a legitimate VPN application.- The victim enters credentials into a fake login window.- The malware exfiltrates credentials and stored VPN configuration data to attacker-controlled infrastructure.- To reduce suspicion, the victim is then redirected to the real vendor site and encouraged to install the legitimate software.That last step is what makes the campaign especially dangerous. Once the real VPN client is installed and begins working normally, the employee may assume the earlier failure was just a technical issue and never realize their credentials were already stolen.Technical details security teams should noteMicrosoft reports that the malicious files were digitally signed using a certificate that has since been revoked, which helped the fake software appear more trustworthy. The campaign also used DLL sideloading and established persistence through the Windows RunOnce registry key. In observed cases, the malware harvested sign-in data and accessed local VPN configuration files for additional intelligence.What businesses should do nowOrganizations should treat this as both a user awareness issue and a control gap around software downloads. Recommended actions include:1. Enforce multifactor authentication on all VPN and remote access accounts.2. Restrict software downloads to approved internal portals or managed app deployment tools.3. Instruct staff not to search the web for business VPN installers unless directed by IT.4. Enable endpoint detection and response in block mode where available.5. Turn on browser protections such as Microsoft Defender SmartScreen or equivalent web filtering.6. Monitor for unusual VPN logins, credential reuse, and sign-ins from unfamiliar devices or locations.7. Review password vault and browser password storage policies for work credentials.QuickMSP perspectiveThis campaign is a good reminder that modern attacks increasingly target user trust, not just software flaws. Even employees who are trying to do the right thing by downloading an approved tool can still be tricked if they rely on search results. For most companies, the safest approach is to centralize software distribution and assume that any externally downloaded remote access tool could be malicious until verified.Bottom lineStorm-2561 shows how attackers are combining search manipulation, trusted branding, and credential theft into a low-friction attack path that can compromise remote access quickly. If your organization still relies on users to find and install VPN clients on their own, now is the time to close that gap.Source: Microsoft Threat Intelligence, “Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft” (March 12, 2026): https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/

CISA has added SolarWinds Web Help Desk vulnerability CVE-2025-26399 to its Known Exploited Vulnerabilities catalog, confirming that defenders should treat this flaw as an active threat rather than a theoretical risk. For managed service providers and small to midsize businesses, that matters because Web Help Desk often sits close to administrative workflows, support operations, and sensitive internal systems.

What happened

On March 9, 2026, CISA announced that three vulnerabilities had been added to its KEV catalog based on evidence of active exploitation. One of the most important for business environments is CVE-2025-26399, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. According to CISA, the flaw can allow command execution on the affected host. In practical terms, that means an exposed or unpatched instance could give an attacker a direct foothold into the environment.

Why this threat deserves attention

This is not just another patch bulletin. When CISA places a CVE into the KEV catalog, it signals that exploitation has already been observed in the wild. That changes the priority level immediately.

For organizations that still rely on Web Help Desk, the business risk includes:

• unauthorized access to help desk infrastructure
• lateral movement into other internal systems
• exposure of credentials or sensitive support data
• service disruption and potential ransomware staging

Why MSPs and IT teams should move fast

Ticketing and service platforms are high-value targets because they often connect people, systems, credentials, and operational workflows in one place. If a threat actor compromises the help desk server, the blast radius can extend well beyond a single application.

The bigger lesson is simple: internet-facing IT management tools should always be treated as priority patching assets. Attackers know that support and remote management systems can become shortcuts into the rest of the network.

What businesses should do now

1. Identify whether SolarWinds Web Help Desk is deployed anywhere in the environment.
2. Apply vendor-recommended fixes or hotfixes immediately.
3. Restrict external exposure to the platform wherever possible.
4. Review logs for suspicious access, unusual process execution, and unexpected admin activity.
5. Rotate potentially exposed credentials if compromise is suspected.
6. Confirm that backup, isolation, and incident response procedures are ready if malicious activity is discovered.

QuickMSP perspective

The organizations that handle threats best are rarely the ones with the most tools. They are the ones that prioritize the right systems first. A KEV-listed flaw in a business-critical management platform belongs at the top of the queue, especially when it can lead to command execution.

If your team is unsure whether a vulnerable support platform is exposed, now is a good time to validate asset inventory, confirm patch status, and review administrative access paths before attackers do it for you.

Sources

• CISA alert: CISA Adds Three Known Exploited Vulnerabilities to Catalog (March 9, 2026)
• CISA KEV catalog entry for CVE-2025-26399

CISA has added CVE-2026-1603, an authentication bypass vulnerability affecting Ivanti Endpoint Manager (EPM), to its Known Exploited Vulnerabilities (KEV) Catalog. That matters because KEV entries are not theoretical risks—they are vulnerabilities CISA says have already been exploited in the wild. For MSPs, internal IT teams, and organizations running Ivanti EPM, this instantly moves the issue into the patch-now, verify-now category.

What is the threat?

According to NIST’s National Vulnerability Database, CVE-2026-1603 is an authentication bypass flaw in Ivanti Endpoint Manager versions before 2024 SU5. A remote, unauthenticated attacker may be able to leak specific stored credential data from an affected system. In practical terms, that means an internet-exposed or otherwise reachable EPM instance could give an attacker a foothold into sensitive administrative data without requiring valid credentials first.

Why this is important right now

• CISA added it to KEV on March 9, 2026, confirming active exploitation.
• The issue affects a product commonly used for endpoint administration, making it especially relevant for MSPs and IT service providers.
• Credential exposure raises the stakes because it can support follow-on attacks, lateral movement, persistence, and broader compromise.
• Unauthenticated attack paths are always high priority since attackers do not need an initial valid account to start exploiting the weakness.

What businesses should do immediately

• Identify all Ivanti Endpoint Manager instances in production, test, DR, and hosted environments.
• Upgrade to Ivanti Endpoint Manager 2024 SU5 or later following vendor guidance.
• Restrict access to EPM management interfaces so they are not publicly reachable from the internet.
• Review logs and monitoring data for unusual authentication behavior, configuration changes, or signs of credential access.
• Rotate sensitive credentials if there is any indication the system was exposed or compromised.
• Check segmentation and admin access controls to reduce blast radius if a management platform is targeted.

What MSPs should tell clients

If your organization or your IT provider uses Ivanti Endpoint Manager, this is not the kind of advisory to leave in the weekly patch queue. The combination of active exploitation, unauthenticated access, and potential credential exposure makes this a same-day remediation priority. Even if your EPM server is not directly internet-facing, attackers regularly chain internal weaknesses after phishing, VPN compromise, or remote access abuse.

The bigger lesson is familiar but still important: tools used to manage endpoints, deploy software, or administer infrastructure are high-value targets. When one of those products lands in the KEV catalog, response speed matters more than perfect change-window timing.

QuickMSP takeaway

CVE-2026-1603 is a live, credible threat with immediate relevance to any business relying on Ivanti Endpoint Manager. If you have not already validated your version, applied the vendor update, and reviewed exposure, now is the time. For small and midsize businesses, waiting on actively exploited management-platform vulnerabilities is a gamble that rarely ends well.

Sources

• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-1603 entry
• NIST NVD: CVE-2026-1603 detail page
• Ivanti advisory reference listed by NVD: Vendor advisory

Proactive Managed Firewall Services That Stop Breaches Before They Happen

Enterprise-grade firewall monitoring and management—24/7 protection for your network without hiring in-house experts. Reduce downtime, ensure compliance, and prevent costly cyberattacks.

Protecting business-critical networks with always-on, proactive security

Managed by Certified Security Engineers

Claim Your Free Security Assessment Now

Enabling secure, compliant, and resilient IT environments for growing businesses

Talk to a FortiGate Specialist

The Hidden Cost of Weak or DIY Firewall Security 

Most Cyber Breaches Start with a Misconfigured Firewall 

• DIY firewall setups → silent security gaps
• Basic or outdated firewalls → blind to modern AI-driven threats 
• No 24/7 monitoring → attacks discovered too late
•  Manual updates → delayed protection against zero-day exploits
• Compliance failures → penalties, audits, and lost trust

Most SMB breaches occur not because of no firewall—but because of poorly managed firewalls.

Why FortiGate + QuickMSP Beats DIY or Resellers 

Enterprise Security Requires Enterprise Management 

DIY / Reseller Setup 

• One-time installation 
• Default configurations 
• No threat monitoring 
• Reactive response 
• Firewall as hardware 

FortiGate + QuickMSP 

• Continuous security lifecycle 
• Custom-hardened policies 
• 24/7 SOC-level monitoring 
• Proactive threat prevention 
• Firewall as a managed service 

---

Who Needs FortiGate Managed Firewalls 

Built for Businesses That Can’t Afford Downtime

Built for Businesses That Can’t Afford Downtime

Shared Services & BPOs handling sensitive data 

Healthcare & clinics requiring compliance

Retail & multi-branch operations

Financial & professional services firms

Cloud-first and hybrid organizations

Growing SMBs targeted by cybercriminals

---

Firewall Configuration & Management Lifecycle

Assessment & Risk Mapping

• Firewall health check
• Network vulnerability scan

Design & Deployment

• Proper firewall sizing
• Segmentation & secure architecture

Threat Protection Setup

• IPS, AV, web filtering, app control
• AI threat intelligence activation

24/7 Monitoring & Response

• Real-time alerts
• Incident containment

Optimization & Reporting

• Performance tuning
• Monthly security reports

---

Why Buy FortiGate from QuickMSP 

Because Security Hardware Alone Is Not Security 

Fortinet-trained & certified engineers

Proper configuration (no default rules)

Continuous monitoring & tuning

 Faster incident response

Local + global support coverage

Clear SLAs and reporting

---

---

When Should a Business Use FortiGate? 

Because Security Hardware Alone Is Not Security 

When handling sensitive data 

When remote work is required 

When compliance matters 

When compliance matters