Trellix Source Code Repo Breached, Vendor Confirms Unauthorized Access

Trellix disclosed that attackers gained unauthorized access to a portion of its source code repository. The company has engaged forensic specialists, notified law enforcement, and says it found no evidence so far that its source code release pipeline or distribution process was tampered with, nor that any code has been exploited downstream.

Details are thin. Trellix has not named the threat actor, specified what code was touched, or said how long the intruders had access before detection. The vendor, formed in 2022 from the McAfee Enterprise and FireEye merger and now owned by Symphony Technology Group, says further information will follow as the investigation progresses.

A source code breach at a security vendor is a high-leverage incident regardless of whether build systems were touched. Even read-only access yields signing logic, detection internals, and unpublished vulnerability knowledge that can be weaponized against Trellix customers. Until the scope and dwell time are pinned down, downstream defenders should treat the integrity assertions as provisional.