Your registry can't stop a valid login. What happens then?

On April 22, 2026, a threat actor used stolen Checkmarx credentials to push malicious images to a trusted Docker Hub repository. The payload quietly collected scan output, encrypted it, and exfiltrated it to attacker-controlled infrastructure. Docker's registry monitoring flagged the push for review within about half an hour, the repository was quarantined, and Docker worked side by side with Socket and Checkmarx to shut it down. This talk is about how. Not the incident itself, but the detection model behind it: what signals fired, why no single one was enough, and what it means to build a supply chain posture where the question is not "can we prevent every breach" but "how fast can we find it and how small is the blast radius." We cover the structural pattern behind Trivy, KICS, LiteLLM and axios: stolen credentials, legitimate publishing flows, short exposure windows. Then we get into what Docker actually does differently: provenance-linked builds, digest pinning, cooldown periods, cross-registry signal sharing, and Docker Hardened Images as the foundation that sits outside the attack surface entirely. You leave with a concrete checklist your team can act on tomorrow, and a mental model that holds regardless of which tool gets hit next.