Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials

A large-scale cyber campaign is abusing GitHub Actions to turn trusted open source projects into weapons against web hosting servers.

Attackers plant malicious workflow files inside compromised repositories and use free GitHub compute power to scan the public internet for weak targets.

The operation focuses on cPanel and WHM servers, which manage websites, email accounts, and databases for countless businesses. Once inside those systems, the malware hunts for cloud keys, payment credentials, and source control tokens that can open more doors.

Analysts from Socket.dev identified the campaign while reviewing suspicious Packagist development versions tied to a legitimate PHP developer.

Socket.dev said in a report shared with Cyber Security News (CSN) that the real malware lived in GitHub Actions workflow files, not in the PHP library code itself.

Between July 12 and 13, 2026, Packagist automatically synced malicious development versions across ten packages linked to the compromised maintainer account.

Each version held between 55 and 62 workflow files that launch temporary Ubuntu runners, download a Linux payload, and begin scanning for vulnerable hosts.

The impact reaches far beyond a single developer. Code searches for unique campaign markers returned thousands of matching workflow files across unrelated repositories, showing a broad effort to hijack automation pipelines and steal secrets at scale.

Hackers Abuse GitHub Actions

The attack chain starts when a compromised repository receives a push or when someone starts a workflow by hand.

GitHub then spins up an ephemeral Ubuntu runner that detects its processor type and pulls a matching Linux payload from a threat actor controlled server.

That payload scans common web ports and tries to exploit CVE-2026-41940, an authentication bypass flaw in cPanel and WHM.

A successful breach can expose multiple customer accounts on one host, along with databases, email settings, and application secrets that power everyday websites.

The workflows send status heartbeats every thirty seconds and upload stolen data in small chunks through HTTP POST requests. Monitored output includes AWS credentials, GitHub and GitLab tokens, OpenAI and Google API keys, Stripe keys, and SSH material.

This pattern echoes earlier cases of a compromised GitHub Action that siphoned continuous integration secrets from trusted pipelines.

Installing the related PHP packages does not run the malware on a developer laptop. Nested workflow files sit ignored inside vendor folders after a normal install.

Only root level Actions inside compromised repositories become the real attack engine, turning free runners into scanners.

cPanel handles account level hosting tasks while WHM sits higher and can manage many accounts from one control plane. That hierarchy makes a single WHM compromise damaging for hosting providers and customers.

Campaign Scale and Defensive Guidance

Stolen source control tokens can feed further repository takeovers and expand software supply chain damage over time. Hosting customers risk exposure of websites and private data when a single WHM panel falls.

The campaign remains active even after one GitHub account was suspended, so defenders should treat the threat as ongoing.

Repository owners should disable suspicious workflows, preserve Actions logs, and rotate GitHub credentials without delay. Teams that manage continuous integration should also review OAuth apps and require approval for changes under the workflows folder.

Similar risks surfaced in a Claude Code GitHub Actions issue that threatened broad repository control through untrusted automation.

Organizations can reduce harm by limiting token permissions, restricting self-hosted runners, and watching logs for payload downloads from raw IP addresses.

Packagist users should avoid unreviewed development versions and pin lockfiles to known good commits. Operators must patch cPanel and WHM quickly, following guidance after the cPanel authentication bypass became actively exploited in the wild.

If compromise is suspected, rotate every server side secret and investigate unauthorized sessions or strange configuration changes.

Continuous integration workflows deserve the same careful review as application code because they execute with real access to build systems.

Credential focused npm package supply chain incidents have already shown how fast stolen cloud keys can spread when warnings go unheeded.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.