Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Attackers compromised a PHP developer's GitHub account to inject 583 malicious workflow files across ten packages, turning them into distributed infrastructure. The campaign abuses GitHub Actions runners to scan for and exploit CVE-2026-41940 in cPanel and WHM servers, bypassing traditional package installation vectors. A Linux payload harvested from these runners exfiltrates sensitive credentials including AWS keys, database access, SSH material, and cloud service tokens. The operation is part
Analysis
TL;DR
- Attackers compromised a PHP developer's GitHub account to inject 583 malicious workflow files across ten packages, turning them into distributed infrastructure.
- The campaign abuses GitHub Actions runners to scan for and exploit CVE-2026-41940 in cPanel and WHM servers, bypassing traditional package installation vectors.
- A Linux payload harvested from these runners exfiltrates sensitive credentials including AWS keys, database access, SSH material, and cloud service tokens.
- The operation is part of a broader trend where threat actors leverage legitimate CI/CD platforms for server-side credential theft and vulnerability scanning.
Why It Matters
This incident highlights a critical shift in supply chain attacks, moving from client-side malware distribution to server-side exploitation via CI/CD pipelines. It demonstrates how compromised repositories can be weaponized to create botnets of virtual machines, posing significant risks to organizations relying on automated build environments and third-party dependencies.
Technical Details
- Attack Vector: Malicious GitHub Actions workflows were added to compromised repositories, triggering execution on GitHub-hosted runners upon push or manual run.
- Exploitation Mechanism: The workflows download architecture-specific Linux payloads from C2 server 43.228.157[.]68, which then scan for and exploit CVE-2026-41940 (authentication bypass) in cPanel/WHM.
- Data Exfiltration: Harvested data includes environment variables, database credentials, SSH keys, Git tokens, and API keys from services like Stripe, SendGrid, and OpenAI, uploaded via HTTP POST.
- Scale: Approximately 6,100 workflow files across the ecosystem contain a unique DNSHook identifier, indicating a widespread, coordinated campaign beyond the initial ten packages.
Industry Insight
- CI/CD Security Audits: Organizations must implement strict monitoring for unauthorized workflow changes in their dependency trees, as attackers are increasingly targeting the build process itself rather than just the code.
- Runner Isolation: Consider isolating GitHub Actions runners or using self-hosted runners with restricted permissions to prevent potential abuse for external scanning or credential harvesting.
- Supply Chain Vigilance: Monitor for anomalous activity in package registries and repository commits, particularly for popular libraries, as compromise of a single maintainer can impact thousands of downstream users.
Disclaimer: The above content is generated by AI and is for reference only.