Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances.

The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13, 2026. The list of affected Packagist packages is below -

• dinushchathurya/nationality-list
• dinushchathurya/srilankan-divisional-secretariats
• dinushchathurya/srilankan-gn-divisions
• dinushchathurya/srilankan-local-authorities
• dinushchathurya/srilankan-mobile-number-validator
• dinushchathurya/srilankan-state-hospitals
• dinushchathurya/srilankan-universities
• dinushchathurya/uk-mobile-number-validator
• dinushchathurya/uk-post-code
• dinushchathurya/websmslk

"The PHP libraries were not the execution path," Socket said in a statement. "Attackers had added dozens of malicious GitHub Actions workflows to the compromised maintainer's source repositories."

The workflows, once triggered by a repository push or manual run, launch GitHub-hosted runners, download a Linux payload from attacker-controlled infrastructure, and scan for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control of the control panel.

The payload, for its part, attempts an authentication bypass, and then proceeds to harvest credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials, and other valuable secrets.

The exact method by which the threat actor gained unauthorized access to the developer's account and pushed malicious changes to the repositories remains unclear.

"Between July 12 and 13, 2026, Packagist automatically synchronized malicious development versions across all ten packages associated with the compromised developer, reflecting changes the threat actor pushed to the developer's GitHub repositories," Socket researcher Kirill Boychenko said.

Each of the affected development versions has been found to contain anywhere between 55 and 62 malicious GitHub Actions workflow files, totaling 583 files across all ten package versions.

Specifically, the YAML automation files launch GitHub-hosted runners when the compromised repository receives a push or when the workflow is manually launched, detect each runner's processor architecture (e.g., 32-bit x86, 64-bit x86, 32-bit ARM, and 64-bit ARM systems), and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at 43.228.157[.]68.

"The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests," Boychenko added. "The output files they monitor include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results."

Unlike other traditional malicious package campaigns, the latest activity does not rely on package users' systems. Instead, the scanning and exploitation run on GitHub-hosted runners launched from compromised repositories, meaning GitHub Actions is abused to power an exploitation campaign aimed at hunting for vulnerable cPanel and WHM servers.

Signs point to a broader campaign that extends beyond one PHP maintainer, with roughly 6,100 workflow files hosted on GitHub containing a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d").

Socket described the campaign as a case of "opportunistic server-side credential theft operation," allowing the attackers to leverage the stolen data for follow-on compromises or monetization pathways.

The disclosure comes as the application security firm also detailed a campaign codenamed Operation Muck and Load that abuses a network of 200 GitHub repositories across 190 accounts to deliver Windows-based malware, including information stealers, loaders and downloaders, droppers, spyware, remote access trojans, and Monero cryptocurrency miners.

The repositories, some of which masquerade as developer utilities and cryptocurrency wallet integrations, conceal a multi-stage attack chain that downloads a PowerShell script responsible for querying various dead drop sites like Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, and Gitcode to fetch a GitHub-hosted password-protected archive, from which the main payload is extracted and launched.

"The GitHub repositories in this cluster were not only lures," Boychenko said. "Several also functioned as malware-bearing repositories, embedding malicious payloads directly in the source tree or delivering them through GitHub release assets."

The activity shares tactical overlaps with previously observed activity associated with the "ischhfd83@rambler[.]ru" email address, which has been tracked under the moniker Water Curse by Trend Micro. The threat cluster is assessed to operate a GitHub-based ghost network to redirect unsuspecting users to GitHub pages hosting malware-laced payloads.

"This model gives threat actors a scalable way to turn ordinary software discovery into malware staging, especially when the lures target users already inclined to run untrusted tools, such as crypto automation, wallet utilities, game cheats, crypters, and offensive tooling," Socket said.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.