Ethical Hacking News
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers: A New Vector for Malicious Actors. Cybersecurity researchers have discovered a large-scale campaign that turns compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager instances.
A large-scale campaign has been discovered that compromised GitHub repositories to create distributed attack infrastructure targeting cPanel and WHM instances. The malicious activity involved dozens of GitHub Actions workflows launched from compromised maintainer's source repositories. The workflows scanned for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability. The attackers harvested credentials, configuration files, environment variables, database access, SSH material, and other valuable secrets. A total of 583 malicious GitHub Actions workflow files were found across all ten affected package versions. A unique DNSHook identifier was used in roughly 6,100 workflow files hosted on GitHub, indicating a broader campaign. An opportunistic server-side credential theft operation was described, allowing attackers to leverage stolen data for follow-on compromises or monetization pathways.
In a recent revelation, cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances. The campaign involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13, 2026.
The list of affected Packagist packages is extensive, encompassing various categories such as nationality lists, divisional secretariats, mobile number validators, state hospitals, universities, UK-based utilities, and post-code systems. The malicious development versions were not the execution path; instead, attackers had added dozens of malicious GitHub Actions workflows to the compromised maintainer's source repositories.
These workflows, once triggered by a repository push or manual run, launch GitHub-hosted runners, download a Linux payload from attacker-controlled infrastructure, and scan for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control of the control panel.
The payload, for its part, attempts an authentication bypass, and then proceeds to harvest credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials, and other valuable secrets. The exact method by which the threat actor gained unauthorized access to the developer's account and pushed malicious changes to the repositories remains unclear.
Between July 12 and 13, 2026, Packist automatically synchronized malicious development versions across all ten packages associated with the compromised developer, reflecting changes the threat actor pushed to the developer's GitHub repositories. Each of the affected development versions has been found to contain anywhere between 55 and 62 malicious GitHub Actions workflow files, totaling 583 files across all ten package versions.
Specifically, the YAML automation files launch GitHub-hosted runners when the compromised repository receives a push or when the workflow is manually launched, detect each runner's processor architecture (e.g., 32-bit x86, 64-bit x86, 32-bit ARM, and 64-bit ARM systems), and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at 43.228.157[.]68.
The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests. The output files they monitor include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results.
Unlike other traditional malicious package campaigns, the latest activity does not rely on package users' systems. Instead, the scanning and exploitation run on GitHub-hosted runners launched from compromised repositories, meaning GitHub Actions is abused to power an exploitation campaign aimed at hunting for vulnerable cPanel and WHM servers.
Signs point to a broader campaign that extends beyond one PHP maintainer, with roughly 6,100 workflow files hosted on GitHub containing a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d"). This campaign is described by Socket as an opportunistic server-side credential theft operation, allowing the attackers to leverage the stolen data for follow-on compromises or monetization pathways.
The disclosure comes as the application security firm also detailed a campaign codenamed Operation Muck and Load that abuses a network of 200 GitHub repositories across 190 accounts to deliver Windows-based malware, including information stealers, loaders, downloaders, droppers, spyware, remote access trojans, and Monero cryptocurrency miners.
The repositories, some of which masquerade as developer utilities and cryptocurrency wallet integrations, conceal a multi-stage attack chain that downloads a PowerShell script responsible for querying various dead drop sites like Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, and Gitcode to fetch a GitHub-hosted password-protected archive, from which the main payload is extracted and launched.
The activity shares tactical overlaps with previously observed activity associated with the "ischhfd83@rambler[.]ru" email address, which has been tracked under the moniker Water Curse by Trend Micro. The threat cluster is assessed to operate a GitHub-based ghost network to redirect unsuspecting users to GitHub pages hosting malware-laced payloads.
This model gives threat actors a scalable way to turn ordinary software discovery into malware staging, especially when the lures target users already inclined to run untrusted tools, such as crypto automation, wallet utilities, game cheats, crypters, and offensive tooling.
Related Information:
https://www.ethicalhackingnews.com/articles/Attackers-Weaponize-GitHub-Actions-Runners-to-Target-cPanel-and-WHM-Servers-A-New-Vector-for-Malicious-Actors-ehn.shtml
https://thehackernews.com/2026/07/attackers-weaponize-github-actions.html
Published: Thu Jul 23 08:23:37 2026 by llama3.2 3B Q4_K_M
