Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances.
Intelligence analysis by Llama
Attackers have weaponized GitHub Actions Runners to target cPanel and WHM servers, using compromised GitHub repositories as distributed attack infrastructure. The campaign involves malicious Packagist development versions and GitHub Actions workflows that launch GitHub-hosted runners to scan for vulnerable servers.
Imagine a group of hackers using a website called GitHub to launch attacks on servers that run cPanel and WHM. They do this by creating fake versions of software that people use to manage their servers, and then using those fake versions to launch attacks on the servers. The attacks are designed to steal sensitive information from the servers, such as passwords and credit card numbers.
Analysis
A $60B Vote of Confidence
The recent campaign involving compromised GitHub repositories and GitHub Actions workflows has shed light on the potential for attackers to use GitHub as a platform for launching attacks. The campaign, which has been described as a case of 'opportunistic server-side credential theft operation,' has allowed attackers to leverage the stolen data for follow-on compromises or monetization pathways.
The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13, 2026. The list of affected Packagist packages is below - dinushchathurya/nationality-list dinushchathurya/srilankan-divisional-secretariats dinushchathurya/srilankan-gn-divisions dinushchathurya/srilankan-local-authorities dinushchathurya/srilankan-mobile-number-validator dinushchathurya/srilankan-state-hospitals dinushchathurya/srilankan-universities dinushchathurya/uk-mobile-number-validator dinushchathurya/uk-post-code dinushchathurya/websmslk
The PHP libraries were not the execution path. Attackers had added dozens of malicious GitHub Actions workflows to the compromised maintainer's source repositories. The workflows, once triggered by a repository push or manual run, launch GitHub-hosted runners, download a Linux payload from attacker-controlled infrastructure, and scan for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control of the control panel.
The payload, for its part, attempts an authentication bypass, and then proceeds to harvest credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials, and other valuable secrets. The exact method by which the threat actor gained unauthorized access to the developer's account and pushed malicious changes to the repositories remains unclear.
Between July 12 and 13, 2026, Packagist automatically synchronized malicious development versions across all ten packages associated with the compromised developer, reflecting changes the threat actor pushed to the developer's GitHub repositories. Each of the affected development versions has been found to contain anywhere between 55 and 62 malicious GitHub Actions workflow files, totaling 583 files across all ten package versions.
Specifically, the YAML automation files launch GitHub-hosted runners when the compromised repository receives a push or when the workflow is manually launched, detect each runner's processor architecture (e.g., 32-bit x86, 64-bit x86, 32-bit ARM, and 64-bit ARM systems), and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at 43.228.157[.]68.
The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests. The output files they monitor include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results.
Unlike other traditional malicious package campaigns, the latest activity does not rely on package users' systems. Instead, the scanning and exploitation run on GitHub-hosted runners launched from compromised repositories, meaning GitHub Actions is abused to power an exploitation campaign aimed at hunting for vulnerable cPanel and WHM servers.
Signs point to a broader campaign that extends beyond one PHP maintainer, with roughly 6,100 workflow files hosted on GitHub containing a unique DNSHook identifier ('f5b0b742-240a-4811-8a5b-b0ba6060685d'). Socket described the campaign as a case of 'opportunistic server-side credential theft operation,' allowing the attackers to leverage the stolen data for follow-on compromises or monetization pathways.
The disclosure comes as the application security firm also detailed a campaign codenamed Operation Muck and Load that abuses a network of 200 GitHub repositories across 190 accounts to deliver Windows-based malware, including information stealers, loaders and downloaders, droppers, spyware, remote access trojans, and Monero cryptocurrency miners.
The repositories, some of which masquerade as developer utilities and cryptocurrency wallet integrations, conceal a multi-stage attack chain that downloads a PowerShell script responsible for querying various dead drop sites like Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, and Gitcode to fetch a GitHub-hosted password-protected archive, from which the main payload is extracted and launched.
The GitHub repositories in this cluster were not only lures. Several also functioned as malware-bearing repositories, embedding malicious payloads directly in the source tree or delivering them through GitHub release assets.
The activity shares tactical overlaps with previously observed activity associated with the 'ischhfd83@rambler[.]ru' email address, which has been tracked under the moniker Water Curse by Trend Micro.
The threat cluster is assessed to operate a GitHub-based ghost network to redirect unsuspecting users to GitHub pages hosting malware-laced payloads.
This model gives threat actors a scalable way to turn ordinary software discovery into malware staging, especially when the lures target users already inclined to run untrusted tools, such as crypto automation, wallet utilities, game cheats, crypters, and offensive tooling.
Key points
- Attackers have weaponized GitHub Actions Runners to target cPanel and WHM servers.
- The campaign involves malicious Packagist development versions and GitHub Actions workflows that launch GitHub-hosted runners to scan for vulnerable servers.
- The attackers have added dozens of malicious GitHub Actions workflows to the compromised maintainer's source repositories.
- The workflows launch GitHub-hosted runners, download a Linux payload from attacker-controlled infrastructure, and scan for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940.
- The payload attempts an authentication bypass and harvests credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials, and other valuable secrets.
If this development plays out positively, it could lead to increased awareness and security measures being taken by GitHub and its users to prevent similar attacks in the future. This could include implementing additional security features, such as two-factor authentication and code reviews, to help prevent malicious code from being pushed to repositories.
On the other hand, if this development plays out negatively, it could lead to a wider spread of malware and a greater risk of data breaches. This could also lead to a loss of trust in GitHub and its users, potentially resulting in a decline in usage and revenue.
