Loading story…
Researchers reported a large-scale software supply chain campaign that abused compromised GitHub repositories and malicious GitHub Actions workflows to turn GitHub-hosted Ubuntu runners into disposable scanning and exploitation infrastructure. The activity was first linked to ten Packagist PHP packages associated with the legitimate developer account dinushchathurya, but the PHP packages themselves were benign; the malicious execution path came from injected workflow files committed to the repositories. Investigators identified 583 malicious workflow files in the initial cluster, all tied by code reuse and a shared DNSHook callback, with payloads downloaded from 43[.]228[.]157[.]68.
The workflows scanned internet-facing systems and attempted to exploit cPanel and WHM authentication bypass flaw CVE-2026-41940, then exfiltrated harvested credentials and configuration data. Stolen material reportedly included cloud keys, source-control tokens, API credentials, database secrets, and SSH-related data from exposed servers. Researchers said the campaign was far broader than one maintainer account, finding about 6,100 linked workflow files and 15,000 to 16,000 additional files matching related indicators across GitHub, and warned the operation likely remains active through forks, mirrors, cached snapshots, stolen credentials, and surviving attacker infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The legitimate developer account dinushchathurya, which had been tied to the initial Packagist exposure, was suspended. Researchers warned that the operation could still persist through forks, mirrors, cached snapshots, stolen credentials, and surviving attacker infrastructure.
Using a shared DNSHook callback and code pivots, researchers connected the activity to roughly 6,100 workflow files and found 15,000 to 16,000 additional related files across GitHub. This indicated the campaign extended well beyond a single maintainer or package set.
The malicious workflows downloaded Linux payloads from 43[.]228[.]157[.]68, scanned internet-facing systems, and attempted exploitation of cPanel and WHM authentication bypass vulnerability CVE-2026-41940. The activity sought to harvest credentials and sensitive configuration data from exposed servers.
Researchers identified a supply-chain campaign in which compromised GitHub repositories contained injected GitHub Actions workflow files. The workflows abused GitHub-hosted runners as disposable infrastructure while the associated PHP package contents remained benign.
Attackers inserted dozens of malicious GitHub Actions workflow files into source repositories linked to 10 Packagist development packages tied to the developer dinushchathurya. The compromise occurred between July 12 and 13, 2026, establishing the infrastructure later used to target vulnerable cPanel and WHM servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityonline.info
Open sourcesocket.dev
Open sourcesemgrep.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a large-scale automated supply chain attack dubbed **Megalodon** that pushed **5,718 malicious commits** into **5,561 GitHub repositories** in less than six hours, using forged CI/CD bot identities and benign-looking commit messages to slip in malicious GitHub Actions workflow files. The workflows requested elevated permissions and carried base64-encoded bash payloads that executed after maintainers merged the changes, harvesting CI/CD environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code and developer secrets. Investigators said the stolen data was exfiltrated over HTTP POST requests to **`216.126.225[.]129:8443`**, with two workflow variants observed, including payloads labeled **SysDiag** and **Optimize-Build**. The most visible downstream impact was a compromise of the **Tiledesk** repository, where a malicious workflow change led to the publication of poisoned **`@tiledesk/tiledesk-server`** npm versions **`2.18.6`** through **`2.18.12`**. Reporting tied the activity to a broader pattern of software supply chain abuse associated with **TeamPCP**, whose earlier incidents affected major open-source and commercial projects and prompted npm to invalidate some write-capable granular access tokens that could bypass 2FA protections. Security firms urged organizations to review repositories for unauthorized workflow changes, block the identified command-and-control infrastructure, rotate exposed secrets and keys, and inspect cloud and CI logs for signs of credential theft or cloud impersonation.
Jun 29, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Jun 29, 2026
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026