A significant cyberattack campaign has surfaced, exploiting GitHub Actions to transform trusted open-source projects into tools for attacking web hosting servers. The perpetrators insert malicious workflow files into compromised repositories, leveraging GitHub’s free computing resources to identify and target vulnerable systems.
The campaign primarily targets cPanel and WHM servers, which play a crucial role in managing websites, email accounts, and databases for numerous businesses. Once inside these systems, the malware seeks cloud keys, payment details, and source control tokens, potentially leading to further breaches.
Targeting Vulnerable cPanel and WHM Servers
Security analysts at Socket.dev uncovered the campaign while examining suspicious Packagist development versions associated with a PHP developer. The investigation revealed that the malware was embedded within GitHub Actions workflow files, not the PHP library code itself.
Between July 12 and 13, 2026, malicious development versions were automatically synced across ten packages linked to the compromised account. Each version contained numerous workflow files that initiated temporary Ubuntu runners, downloaded a Linux payload, and began scanning for susceptible hosts.
The scope of this operation extends beyond a single developer, with searches for unique campaign markers identifying thousands of similar workflow files in unrelated repositories. This widespread effort indicates a concerted attempt to hijack automation pipelines and steal sensitive information on a large scale.
Exploiting GitHub Actions for Breaches
The attack begins when a compromised repository receives a push or a manual workflow initiation. GitHub then creates an ephemeral Ubuntu runner that identifies its processor type and retrieves a corresponding Linux payload from a server under hacker control.
This payload scans common web ports, attempting to exploit CVE-2026-41940, an authentication bypass vulnerability in cPanel and WHM. A successful exploit can expose multiple customer accounts, databases, email settings, and application secrets.
The workflows transmit status updates every thirty seconds and upload stolen data in small chunks via HTTP POST requests. The stolen data includes AWS credentials, GitHub and GitLab tokens, API keys from OpenAI and Google, Stripe keys, and SSH materials.
Defensive Measures and Future Outlook
The campaign’s impact is far-reaching, with stolen source control tokens potentially leading to further repository takeovers and extended software supply chain damage. Even after the suspension of one GitHub account, the threat remains active, necessitating ongoing vigilance from defenders.
Repository owners should disable suspicious workflows, preserve Actions logs, and promptly rotate GitHub credentials. Teams involved in continuous integration should review OAuth applications and require approval for changes to workflow files.
Organizations can mitigate risks by limiting token permissions, restricting self-hosted runners, and monitoring logs for payload downloads from raw IP addresses. It’s crucial for Packagist users to avoid unreviewed development versions and secure cPanel and WHM installations against known vulnerabilities. Continuous integration workflows require careful scrutiny, as they operate with real access to critical systems.
In conclusion, this campaign underscores the importance of rigorous security practices in managing open-source projects and cloud infrastructure. As hackers become more sophisticated in their methods, maintaining robust defenses against such threats is essential to safeguarding sensitive data and maintaining trust in digital services.
