Compromised GitHub Actions Repositories Fuel cPanel/WHM Exploitation and Credential Theft

Jul 22, 2026 · Original article ↗

Summary

Socket Dev Research found a broad campaign using malicious GitHub Actions workflows in compromised repositories to scan for and exploit cPanel/WHM CVE-2026-41940, then steal credentials. Affected Packagist versions reflected repository compromise; installing them alone,

Key points

The campaign used malicious GitHub Actions workflows in compromised repositories to launch temporary GitHub-hosted Linux runners that downloaded and ran a scanner.
The scanner targeted internet-facing cPanel and WHM systems for exploitation of CVE-2026-41940, an authentication bypass, and searched for credentials and configuration data.
Workflows in ten affected Packagist development versions totaled 583 files, but installing the packages alone did not execute them; the workflows ran from repository roots on pushes or manual launches.
The workflows sent execution heartbeats and exfiltrated findings, including cloud and source-control credentials, database information, SSH material, and API keys, to attacker-controlled infrastructure.
Researchers found thousands of matching workflow files across unrelated repositories; these counts are files, not confirmed compromised repositories or accounts.
The report considered the campaign ongoing at publication. Recommended steps include disabling suspicious workflows, reviewing repository access, rotating exposed credentials, and patching cPanel/WHM.

Article Details

Attack Vectors: The threat actor pushed malicious workflow files into compromised GitHub repositories. Repository pushes or manual workflow launches executed them on GitHub-hosted Ubuntu runners.
The workflows downloaded an architecture-specific Linux payload from a threat actor-controlled server. The payload scanned internet-facing cPanel and WHM systems and attempted to exploit CVE-2026-41940.
The workflows monitored collected credentials and exploitation results, then sent new content to the threat actor through HTTP POST requests. They also sent execution-status heartbeats.
Some recovered workflows queried a DNSHook hostname to confirm command execution.
Packagist synchronized the compromised repositories into development package versions, but ordinary package installation did not execute the nested workflows.
Defensive Notes: Repository owners should disable suspicious workflows, preserve commits and Actions logs, rotate GitHub credentials, review OAuth and GitHub App access, and require approval for changes under .github/workflows.
Minimize GITHUB_TOKEN permissions, restrict self-hosted runners, monitor CI egress, and alert on payload downloads from raw IP addresses.
Packagist users should avoid unreviewed development versions, verify lockfile commit references, remove affected development versions, and update lockfiles to known-good commits or stable releases.
Operators should update cPanel and WHM to a patched build, follow current remediation instructions, and run cPanel’s IOC detection script on servers that remained exposed while unpatched.
Where compromise is suspected, rotate potentially exposed server-side credentials and investigate unauthorized sessions and other post-exploitation artifacts.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`f5b0b742-240a-4811-8a5b-b0ba6060685d[.]dnshook[.]site`	DNS callback hostname queried by recovered workflows to confirm command execution.
IPV4	`43[.]228[.]157[.]68`	Threat actor-controlled server used for payload delivery, execution telemetry, and result exfiltration.
SHA256	`22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1`	SHA-256 of the recovered AMD64 Linux payload.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/dl/386`	Architecture-specific Linux payload delivery URL.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/dl/amd64`	Architecture-specific Linux payload delivery URL.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/dl/arm`	Architecture-specific Linux payload delivery URL.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/dl/arm64`	Architecture-specific Linux payload delivery URL.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/github-heartbeat`	Endpoint receiving execution-status reports from malicious workflows.
URL	`hxxp[:]//43[.]228[.]157[.]68/api/github-results`	Endpoint receiving exploitation results and harvested data from malicious workflows.