Compromised GitHub Actions Workflows Drove Mass cPanel and WHM Exploitation

Researchers reported a large-scale software supply chain campaign that abused compromised GitHub repositories and malicious GitHub Actions workflows to turn GitHub-hosted Ubuntu runners into disposable scanning and exploitation infrastructure. The activity was first linked to ten Packagist PHP packages associated with the legitimate developer account dinushchathurya, but the PHP packages themselves were benign; the malicious execution path came from injected workflow files committed to the repositories. Investigators identified 583 malicious workflow files in the initial cluster, all tied by code reuse and a shared DNSHook callback, with payloads downloaded from 43[.]228[.]157[.]68.

The workflows scanned internet-facing systems and attempted to exploit cPanel and WHM authentication bypass flaw CVE-2026-41940, then exfiltrated harvested credentials and configuration data. Stolen material reportedly included cloud keys, source-control tokens, API credentials, database secrets, and SSH-related data from exposed servers. Researchers said the campaign was far broader than one maintainer account, finding about 6,100 linked workflow files and 15,000 to 16,000 additional files matching related indicators across GitHub, and warned the operation likely remains active through forks, mirrors, cached snapshots, stolen credentials, and surviving attacker infrastructure.