Trellix hacked: source code from McAfee+FireEye stolen

One of the basic premises of information security is that nobody is immune — including the people who sell immunity. On 7 May 2026, the RansomHouse group added Trellix to its dark web leak site, claiming it had compromised the company's source code repository on 17 April. Trellix — created by merging McAfee's enterprise division with FireEye under a single XDR platform — protects more than 50,000 organisations and, by the company's own count, more than 200 million endpoints worldwide. The product that was supposed to be impenetrable was opened from the inside.

Who Trellix are

For anyone who doesn't follow the corporate security market: Trellix emerged when Symphony Technology Group (STG) merged McAfee's enterprise division with FireEye and launched the Trellix brand in 2022. The result is an XDR (Extended Detection and Response) platform with customers in government, banking, healthcare and critical infrastructure across dozens of countries.

Being in Trellix's portfolio means having agents installed on endpoints, access to security logs, integrations with firewalls and SIEMs. It's the kind of vendor that, if compromised, can open doors no isolated vulnerability ever could.

Timeline of the incident

• 17 April 2026 — According to RansomHouse, initial access to the source code repository happened on this date.
• 2 May 2026 — Trellix publicly confirms it has "identified unauthorised access to a portion of its source code repository" and that it is already working with external forensic specialists. The company also notified the authorities.
• 7 May 2026 — RansomHouse lists Trellix on its leak site. Screenshots released and analysed by Cybernews show internal dashboards for VMware, Rubrik and Dell EMC — suggesting the access went beyond the declared repository.

Trellix says it has found no evidence that the source code was exploited or that the software distribution process was affected. The investigation remains active. When Bleeping Computer asked whether the incident reported by RansomHouse and the one announced by the company were the same event, a spokesperson said only that they were "looking into the claims" — neither confirming nor denying the link.

Who RansomHouse are

RansomHouse has operated since 2021 and is tracked by Palo Alto Networks as Jolly Scorpius. The group works on the double extortion model: it steals data before encrypting and threatens to publish everything if the ransom isn't paid. To scale attacks in corporate environments, it uses its own tooling:

• MrAgent — automates ransomware deployment across VMware ESXi environments, attacking multiple VMs simultaneously.
• Mario — the group's encryptor, which from December 2025 moved to double encryption with primary and secondary keys, according to Unit42 documentation, making recovery without payment practically unviable.

The group's preferred initial access vector is vulnerabilities in internet-facing products: Citrix NetScaler, Palo Alto GlobalProtect and misconfigured VPN appliances. Trellix hasn't confirmed the specific vector, but those are the most likely candidates based on the group's history.

Why a security company's source code matters

When the source code of a security product leaks, the potential damage goes well beyond corporate embarrassment. With access to the code, attackers can:

• Map out blind spots: detection paths that aren't covered, signature formats, hardcoded exceptions in the antivirus engine.
• Develop malware designed to evade Trellix's detections specifically — before any patch is published.
• Identify vulnerabilities in the agent itself, installed on customer endpoints, potentially disabling protection ahead of a larger attack.

Trellix insists there is no evidence of active exploitation so far. But "so far" is the worrying part. The code may be under quiet analysis, and the real impact may only surface months later — exactly as happened in the supply chain attack against JDownloader in May 2026, where the compromise window stayed open for 48 hours before it was detected.

What Trellix customers should do now

If you or your organisation uses Trellix products (formerly McAfee ENS, formerly FireEye Helix, Trellix XDR), the recommended actions are:

• Monitor Trellix's official statements at trellix.com/statement — the company has promised updates as the investigation progresses.
• Review EDR logs for anomalous behaviour from the agent itself: unexpected auto-updates, outbound connections to unusual IPs, privilege escalation.
• Verify binary integrity — compare the hashes of installed executables against those published officially by the vendor.
• Open a support ticket asking for confirmation of the integrity of installers distributed over the past few weeks.
• Don't uninstall the agent immediately without an active alternative in place: that creates a zero-protection window that may be worse than the current risk.

For organisations still relying on a single layer of defence, this case reinforces why encrypted DNS control and network segmentation work as complementary layers even when the primary EDR fails or is compromised.

The lesson the market still hasn't learned

The Trellix incident isn't the first and won't be the last to involve a security vendor as the target. SolarWinds in 2020, Kaseya in 2021, and now Trellix in 2026 — all follow the same pattern: compromise the trusted link in the supply chain, the supplier with broad access to the target environment. The same model exploited by ShinyHunters against Instructure in April 2026 also starts with a critical infrastructure supplier.

The question every security team should answer today: if one of our security vendors were compromised, how long would it take us to find out? If the answer is "I don't know" or "weeks", the problem isn't RansomHouse — it's the model of implicit trust in third parties with privileged access to your environment. Review that before somebody else reviews it for you.