GitHub Actions Runners Exploited: Attackers Target cPanel & WHM Servers

Key Takeaways

• Between July 12‑13 2026, attackers compromised the GitHub account of PHP/DevOps developer dinushchathurya and injected dozens of malicious GitHub Actions workflows into ten of his Packagist packages.
• The workflows launch GitHub‑hosted runners that download a Linux payload from a command‑and‑control server (43.228.157.68) and scan for cPanel/WHM instances vulnerable to CVE‑2026‑41940, an authentication‑bypass flaw.
• Once a vulnerable panel is found, the payload harvests a wide range of secrets—AWS/GitHub tokens, SSH keys, database credentials, payment‑service keys, OpenAI/Google API keys, etc.—and exfiltrates them via HTTP POST to the attacker’s infrastructure.
• The campaign does not rely on victims installing malicious packages; instead, it abuses GitHub Actions as a distributed attack platform, making detection harder for traditional software‑supply‑chain defenses.
• A broader ghost network is indicated by roughly 6,100 workflow files containing a unique DNSHook identifier (“f5b0b742‑240a‑4811‑8a5b‑b0ba6060685d”) across many repositories, suggesting the tactic may be reused against other maintainers.
• Socket researchers also disclosed Operation Muck and Load, a separate but related campaign that weaponizes GitHub repositories to distribute Windows malware, showing attackers are increasingly using GitHub’s ecosystem for multi‑stage, cross‑platform attacks.
• Defenders should monitor anomalous GitHub Actions usage, enforce least‑privilege repository permissions, enable required‑review and branch‑protection rules, and scan workflow files for suspicious external calls or hard‑coded IP addresses.

Overview of the Campaign
Cybersecurity researchers at Socket uncovered a large‑scale operation that turned compromised GitHub repositories into a distributed attack infrastructure targeting cPanel and WebHost Manager (WHM) instances. The threat actor gained unauthorized access to the account of a legitimate PHP and DevOps developer, dinushchathurya, and used it to push malicious changes to ten of his Packagist‑hosted libraries. Rather than relying on the traditional route of tricking users into installing a poisoned package, the attackers abused GitHub Actions—GitHub’s continuous‑integration service—to launch scanning and exploitation jobs directly from the compromised repositories. This approach leverages the trust and compute resources inherent to GitHub‑hosted runners, allowing the malicious activity to blend in with legitimate CI/CD workflows.

Compromised Packages and Timeline
The affected packages, all under the namespace dinushchathurya, span a variety of geographic and utility‑focused PHP libraries:

• dinushchathurya/nationality-list
• dinushchathurya/srilankan-divisional-secretariats
• dinushchathurya/srilankan-gn-divisions
• dinushchathurya/srilankan-local-authorities
• dinushchathurya/srilankan-mobile-number-validator
• dinushchathurya/srilankan-state-hospitals
• dinushchathurya/srilankan-universities
• dinushchathurya/uk-mobile-number-validator
• dinushchathurya/uk-post-code
• dinushchathurya/websmslk

Between July 12 and July 13, 2026, Packagist automatically synchronized malicious development versions across all ten packages, reflecting the changes the threat actor pushed to the developer’s GitHub repositories. Each of the compromised development versions contained between 55 and 62 malicious GitHub Actions workflow files, amounting to a total of 583 rogue workflows across the ten packages. The tight time window suggests a rapid, coordinated push designed to maximize exposure before detection.

GitHub Actions Workflow Abuse
The core of the attack lies in the malicious GitHub Actions workflows (YAML files) that were added to each repository. These workflows are configured to trigger on two events: a push to the repository or a manual run via the GitHub UI. When triggered, they:

1. Launch a GitHub‑hosted runner appropriate to the repository’s default operating system.
2. Detect the runner’s processor architecture (supporting 32‑bit/64‑bit x86 and ARM variants).
3. Download a compatible Linux payload from a hard‑coded command‑and‑control (C2) server at 43.228.157.68.
4. Execute the payload, which scans for cPanel/WHM servers exposed to the internet.

Because the workflows run on GitHub’s infrastructure, they benefit from the platform’s generous resource limits and appear as legitimate CI activity, reducing the likelihood of immediate detection by repository owners or automated security scans that focus only on code changes rather than CI configuration.

Payload Function and C2 Infrastructure
The downloaded Linux payload performs a multi‑stage operation:

• Authentication bypass using the exploit for CVE‑2026‑41940, a vulnerability that lets remote attackers bypass login mechanisms in cPanel/WHM and obtain administrative control.
• Post‑exploitation harvesting of credentials, configuration files, environment variables, database connection strings, SSH private keys, Git tokens, cloud service keys (AWS, Azure, GCP), payment‑service credentials (Stripe, PayPal), and API keys for services such as OpenAI, Google, SendGrid, and Mailgun.
• Exfiltration of the gathered data via HTTP POST requests back to the attacker’s C2 server, where it is stored for further abuse or monetization.

The workflows also continuously report execution status and upload newly collected results, giving the threat actor near‑real‑time visibility into the campaign’s success rate and the value of the harvested secrets.

Attack Mechanics and Vulnerability Exploited
CVE‑2026‑41940 is an authentication‑bypass flaw affecting certain versions of cPanel and WHM. By sending a specially crafted request, an attacker can sidestep the login mechanism and gain privileged access to the control panel without needing valid credentials. The payload leverages this vulnerability to:

• Obtain a root‑level session within the hosting control panel.
• Extract sensitive configuration files (e.g., /etc/passwd, MySQL credentials, SSL certificates).
• Establish persistent access via SSH keys or API tokens harvested from the compromised environment.

The exploit’s simplicity—requiring only a single HTTP request—makes it ideal for automated scanning campaigns like the one observed, where thousands of potential targets can be probed quickly using disposable GitHub‑hosted runners.

Data Exfiltration and Credential Harvesting
Once a vulnerable cPanel/WHM instance is compromised, the payload systematically searches for high‑value data:

• Cloud credentials: AWS Access Key IDs/Secret Access Keys, Azure storage keys, GCP service‑account JSON files.
• Developer tokens: GitHub personal access tokens, GitLab CI tokens, Docker Hub credentials.
• Third‑party service keys: Stripe secret keys, SendGrid SMTP credentials, Mailgun API keys, OpenAI API keys.
• Database connection strings: MySQL, PostgreSQL, MongoDB credentials often stored in configuration files or environment variables.
• SSH material: Private keys, authorized_keys files, and known_hosts entries.
• Miscellaneous secrets: Environment variables containing API keys, encryption salts, and internal service tokens.

All harvested items are encrypted (if at all) only minimally before being transmitted via POST to the C2 server, where they can be bundled, sold on underground markets, or used to launch further compromises such as credential stuffing, cloud‑resource hijacking, or supply‑chain attacks.

Broader Campaign Indicators
Socket’s analysis revealed that the malicious workflows contain a unique DNSHook identifier: f5b0b742‑240a‑4811‑8a5b‑b0ba6060685d. Approximately 6,100 workflow files across GitHub share this identifier, hinting at a far‑reaching “ghost network” of compromised or attacker‑controlled repositories. This suggests that the threat actor may have:

• Automated the creation of malicious workflows across many accounts, possibly via credential‑stuffing or phishing campaigns targeting maintainers.
• Leveraged the same C2 infrastructure and payload across multiple targets, scaling the operation without needing to develop new exploits for each victim.

The presence of a shared identifier enables defenders to hunt for similar patterns in public repositories, allowing early detection before the workflows are triggered.

Comparison with Operation Muck and Load
In tandem with the cPanel/WHM campaign, Socket disclosed Operation Muck and Load, a separate but thematically related initiative. This operation abuses roughly 200 GitHub repositories spanning 190 accounts to distribute Windows‑based malware, including information stealers, loaders, downloaders, droppers, spyware, remote access trojans (RATs), and Monero cryptocurrency miners. Key similarities include:

• Use of GitHub repositories as both lures (masquerading as developer utilities, crypto wallets, game cheats) and malware hosts (embedding payloads directly in source trees or release assets).
• Multi‑stage infection chains that retrieve additional payloads from dead‑drop sites (Pastebin, Telegram, YouTube, Instagram, Google Docs, Gitcode).
• Reliance on GitHub’s trust model to bypass traditional email‑ or web‑based defenses.

The tactical overlap—particularly the reuse of the same email address (ischhfd83@rambler[.]ru) linked to the “Water Curse” cluster tracked by Trend Micro—suggests a single threat actor or closely affiliated group is experimenting with multiple payload families across Linux and Windows ecosystems, using GitHub as a universal staging platform.

Implications and Defensive Recommendations
The abuse of GitHub Actions as a distributed attack infrastructure represents an evolution in supply‑chain threats. Traditional defenses that focus solely on scanning uploaded packages for malicious code are insufficient when the malicious activity resides in CI configuration files. Organizations and maintainers should consider the following mitigations:

1. Enforce Repository Hygiene

   • Require branch protection rules that mandate pull‑request reviews and status checks before merging.
   • Enable required signed commits or commit‑signing verification to detect unauthorized pushes.

2. Monitor GitHub Actions Usage

   • Alert on workflows that download executables or scripts from external IP addresses or domains not on an approved list.
   • Detect workflows containing a large number of files (e.g., >50) or those with obfuscated names, as seen in this campaign.

3. Implement Least‑Privilege Permissions

   • Limit GitHub token scopes for Actions to only what is necessary (e.g., contents: read, issues: write).
   • Avoid granting workflow or admin permissions to Actions unless absolutely required.

4. Audit Third‑Party Dependencies

   • Use tools that scan not only package code but also associated CI/CD configuration for anomalies.
   • Subscribe to vulnerability feeds for critical CVEs like CVE‑2026‑41940 and apply patches promptly.

5. Deploy Network‑Based Controls

   • Block outbound connections to known malicious IPs (e.g., 43.228.157.68) at the firewall or proxy level.
   • Employ DNS sinkholing or threat‑intelligence feeds to catch C2 communication attempts.
6. Educate Maintainers and Contributors
   • Raise awareness about phishing and credential‑theft tactics that could lead to account takeover.
   • Encourage the use of two‑factor authentication (2FA) and hardware‑based security keys for GitHub accounts.

By adopting these measures, organizations can reduce the risk of their GitHub repositories being conscripted into large‑scale scanning and exploitation campaigns, preserving both the integrity of their code and the security of the broader software ecosystem.