Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign

What it is

Socket's analysis of a GitHub Actions abuse campaign traced from ten malicious Packagist development versions (branch-based dev versions, not stable releases) tied to legitimate PHP/DevOps developer dinushchathurya. The payload exploits CVE-2026-41940, a cPanel/WHM authentication bypass. The critical detail beyond the summary: the malware is not in the PHP, and the infection does not propagate through package consumers.

How it works

The threat actor pushed malicious .github/workflows/ files to the developer's compromised repos; Packagist auto-synced these between July 12–13, 2026. Each affected dev version carried 55–62 workflow files (583 total). The workflows launch ephemeral Ubuntu GitHub-hosted runners, detect processor architecture, pull the matching Linux scanner/exploit binary from C2 43.228.157.68, scan internet-facing hosts for cPanel/WHM, exploit CVE-2026-41940, and POST harvested secrets and RCE output back to the actor.

Preconditions / Affected

Execution requires a repository with .github/workflows/ at its root that receives a push or is manually triggered. It does not fire from:

• installing an affected package (Packagist drops it in the consumer's vendor/, where GitHub ignores nested workflows);
• cloning the repo locally.

So the exposed party is an owner of a repo whose root workflows were tampered with — not the PHP package's downstream users. Downstream targets are internet-facing cPanel/WHM control planes and any secrets on them (AWS, GitHub/GitLab tokens, OpenAI/Google keys, Stripe, SendGrid, Mailgun, SSH, DB, Git remotes).

What to do

Hunt across your own org's repos for the campaign's fingerprints. Socket's GitHub code searches keyed on:

• the unique DNSHook identifier (~6,100 matches)
• the C2 address, scanner command, credential filenames, heartbeat endpoint, and exfiltration logic (~15,000–16,000 matches)

Search your repos for these strings and for unexpected root-level .github/workflows/ additions; treat any developer-account compromise as also compromising source-control tokens (which enable further repo compromise). Patch cPanel/WHM against CVE-2026-41940 on any internet-facing instance.

flowchart TD
  A[Compromised repo] --> B{workflow at repo root?}
  B -- no, in vendor/ or cloned --> N[No execution]
  B -- yes + push/manual --> R[Ephemeral runner]
  R --> C[Pull payload from 43.228.157.68]
  C --> S[Scan + exploit CVE-2026-41940]
  S --> X[POST secrets to C2]

Caveats

The 6,100 / 15,000–16,000 figures are matching files, not confirmed compromised repos. One repo can hold many workflows, GitHub groups identical files, and some matching accounts may be actor-controlled staging infrastructure rather than victims. The distinctive shared code across unrelated repos does confirm the campaign is far broader than the ten Packagist packages.