Attackers Weaponize GitHub Actions

Overview

Cybersecurity researchers have uncovered a large‑scale campaign that weaponizes GitHub Actions runners to launch attacks against cPanel and WebHost Manager (WHM) servers. Unlike traditional malicious package campaigns, this operation turns compromised GitHub repositories into distributed exploitation infrastructure, abusing automation workflows to scan and exploit vulnerable servers.

How the Attack Works

• Attackers compromised 10 Packagist packages linked to developer dinushchathurya between July 12–13, 2026.
• Instead of altering PHP libraries, they injected malicious GitHub Actions workflows into repositories.
• Each workflow:
  • Launches a GitHub‑hosted runner when triggered.
  • Detects the runner’s processor architecture (x86, ARM, etc.).
  • Downloads a Linux payload from attacker infrastructure (43.228.157[.]68).
  • Exploits CVE‑2026‑41940, an authentication bypass flaw in cPanel/WHM.
  • Harvests sensitive data: AWS credentials, GitHub/GitLab tokens, API keys, Stripe/SendGrid/Mailgun credentials, SSH material, database info, and payment service secrets.

Across the 10 packages, researchers found 583 malicious workflow files, each reporting execution status and uploading stolen data via HTTP POST requests.

Indicators of a Broader Campaign

• Signs point to a larger operation beyond one PHP maintainer.
• Roughly 6,100 workflow files across GitHub contained a unique DNSHook identifier (f5b0b742-240a-4811-8a5b-b0ba6060685d).
• Researchers described the activity as an “opportunistic server‑side credential theft operation”, enabling attackers to monetize stolen secrets or use them for follow‑on compromises.

Related Campaigns

The disclosure coincides with Operation Muck and Load, another campaign abusing GitHub repositories:

• Involved 200 repositories across 190 accounts.
• Delivered Windows malware including info stealers, loaders, spyware, RATs, and cryptocurrency miners.
• Attack chain used PowerShell scripts to fetch payloads from dead‑drop sites like Pastebin, Telegram, YouTube, Google Docs, and GitHub.
• Some repositories masqueraded as developer utilities or crypto wallet integrations, embedding malware directly in source trees or release assets.

This activity overlaps with threat actor Water Curse, tracked by Trend Micro, which operates a GitHub‑based ghost network to redirect users to malware‑laden pages.

Defensive Recommendations

Organizations should:

• Audit GitHub repositories for unexpected workflow files.
• Restrict GitHub Actions permissions to limit runner capabilities.
• Monitor outbound traffic for suspicious connections to attacker infrastructure.
• Patch cPanel/WHM servers against CVE‑2026‑41940.
• Review credentials for potential leaks, especially cloud and payment service keys.

Expert in the Cloud Insight

This campaign demonstrates how developer infrastructure itself can be weaponized. By abusing GitHub Actions runners, attackers bypass end‑user systems and directly harness cloud automation to power exploitation. For defenders, the lesson is clear: CI/CD pipelines are now part of the attack surface — they must be monitored, hardened, and treated as critical assets in enterprise security.