A new cyber campaign has been uncovered in which attackers are abusing GitHub Actions runners and compromised GitHub repositories to launch attacks against internet-facing cPanel and WebHost Manager (WHM) servers. Instead of directly attacking victims from their own systems, the threat actors are using GitHub’s cloud infrastructure to perform scanning, exploitation, and data theft. Security researchers say this is a large-scale operation that highlights how trusted developer platforms are increasingly being misused in cyberattacks.
The attack began after cybercriminals compromised several legitimate GitHub repositories and injected malicious GitHub Actions workflows into them. These workflows automatically started temporary GitHub-hosted runners, downloaded Linux-based payloads, and turned them into attack systems. Researchers also found that development versions of multiple Packagist PHP packages were affected, but the main goal was to use the compromised repositories as attack infrastructure rather than spreading malware through the packages themselves.
Once the malicious workflow was executed, the GitHub Actions runner downloaded a payload from attacker-controlled servers and started scanning the internet for exposed cPanel and WHM systems. The malware specifically searched for servers vulnerable to CVE-2026-41940, a critical authentication bypass vulnerability that allows attackers to gain unauthorized administrative access. By using thousands of temporary GitHub runners, the attackers distributed their scanning activity across many different cloud systems.
After identifying vulnerable servers, the malware attempted to exploit CVE-2026-41940 and searched compromised systems for sensitive information. The attackers looked for Git repositories, environment variables, configuration files, API keys, cloud credentials, and other valuable secrets stored on the server. The collected information was then sent back to attacker-controlled infrastructure, allowing them to steal credentials that could be used in future attacks.
Researchers noted that this campaign is different from traditional software supply chain attacks. Instead of distributing malware through software packages alone, the attackers transformed GitHub Actions into a distributed attack platform. Every compromised repository became capable of launching new GitHub-hosted runners that scanned targets, exploited vulnerable servers, and exfiltrated sensitive information, making the campaign much harder to detect and block.
The campaign mainly targets cPanel and WHM servers because they are widely used by web hosting providers and organizations to manage websites, databases, email services, and server configurations. A successful compromise can expose sensitive customer data, website credentials, and cloud secrets while giving attackers a strong foothold inside hosting environments. This makes the campaign particularly dangerous for organizations running unpatched internet-facing servers.
Security experts recommend that organizations immediately review GitHub repositories for unauthorized workflow changes and monitor GitHub Actions activity for unusual executions. They also advise enabling strong repository protections, carefully reviewing workflow files before merging changes, and securing developer accounts with multi-factor authentication. Most importantly, all cPanel and WHM servers should be updated with the latest security patches to protect against CVE-2026-41940.
This incident shows how attackers are constantly finding new ways to misuse trusted cloud services and developer platforms for large-scale cyberattacks. By combining compromised GitHub repositories, GitHub Actions runners, and a critical cPanel vulnerability, the threat actors created a powerful distributed attack network capable of scanning, exploiting, and stealing credentials from vulnerable systems. The campaign serves as another reminder that securing software supply chains and keeping servers fully patched remain essential for defending modern IT environments.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
