Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances.
The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13, 2026. The list of affected Packagist packages is below -
- dinushchathurya/nationality-list
- dinushchathurya/srilankan-divisional-secretariats
- dinushchathurya/srilankan-gn-divisions
- dinushchathurya/srilankan-local-authorities
- dinushchathurya/srilankan-mobile-number-validator
- dinushchathurya/srilankan-state-hospitals
- dinushchathurya/srilankan-universities
- dinushchathurya/uk-mobile-number-validator
- dinushchathurya/uk-post-code
- dinushchathurya/websmslk
"The PHP libraries were not the execution path," Socket said in a statement. "Attackers had added dozens of malicious GitHub Actions workflows to the compromised maintainer's source repositories."
The workflows, once triggered by a repository push or manual run, launch GitHub-hosted runners, download a Linux payload from attacker-controlled infrastructure, and scan for vulnerable cPanel and WHM servers susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control of the control panel.
The payload, for its part, attempts an authentication bypass, and then proceeds to harvest credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials, and other valuable secrets.
The exact method by which the threat actor gained unauthorized access to the developer's account and pushed malicious changes to the repositories remains unclear.
"Between July 12 and 13, 2026, Packagist automatically synchronized malicious development versions across all ten packages associated with the compromised developer, reflecting changes the threat actor pushed to the developer's GitHub repositories," Socket researcher Kirill Boychenko said.
Each of the affected development versions has been found to contain anywhere between 55 and 62 malicious GitHub Actions workflow files, totaling 583 files across all ten package versions.
Specifically, the YAML automation files launch GitHub-hosted runners when the compromised repository receives a push or when the workflow is manually launched, detect each runner's processor architecture (e.g., 32-bit x86, 64-bit x86, 32-bit ARM, and 64-bit ARM systems), and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at 43.228.157[.]68.
"The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests," Boychenko added. "The output files they monitor include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results."
Unlike other traditional malicious package campaigns, the latest activity does not rely on package users' systems. Instead, the scanning and exploitation run on GitHub-hosted runners launched from compromised repositories, meaning GitHub Actions is abused to power an exploitation campaign aimed at hunting for vulnerable cPanel and WHM servers.
Signs point to a broader campaign that extends beyond one PHP maintainer, with roughly 6,100 workflow files hosted on GitHub containing a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d").
Socket described the campaign as a case of "opportunistic server-side credential theft operation," allowing the attackers to leverage the stolen data for follow-on compromises or monetization pathways.
The disclosure comes as the application security firm also detailed a campaign codenamed Operation Muck and Load that abuses a network of 200 GitHub repositories across 190 accounts to deliver Windows-based malware, including information stealers, loaders and downloaders, droppers, spyware, remote access trojans, and Monero cryptocurrency miners.
The repositories, some of which masquerade as developer utilities and cryptocurrency wallet integrations, conceal a multi-stage attack chain that downloads a PowerShell script responsible for querying various dead drop sites like Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, and Gitcode to fetch a GitHub-hosted password-protected archive, from which the main payload is extracted and launched.
"The GitHub repositories in this cluster were not only lures," Boychenko said. "Several also functioned as malware-bearing repositories, embedding malicious payloads directly in the source tree or delivering them through GitHub release assets."
The activity shares tactical overlaps with previously observed activity associated with the "ischhfd83@rambler[.]ru" email address, which has been tracked under the moniker Water Curse by Trend Micro. The threat cluster is assessed to operate a GitHub-based ghost network to redirect unsuspecting users to GitHub pages hosting malware-laced payloads.
"This model gives threat actors a scalable way to turn ordinary software discovery into malware staging, especially when the lures target users already inclined to run untrusted tools, such as crypto automation, wallet utilities, game cheats, crypters, and offensive tooling," Socket said.
Facts Only
Threat actors compromised the GitHub account of developer dinushchathurya.
Between July 12 and 13, 2026, malicious GitHub Actions workflows were added to ten Packagist packages.
Affected packages include nationality-list, srilankan-divisional-secretariats, srilankan-gn-divisions, srilankan-local-authorities, srilankan-mobile-number-validator, srilankan-state-hospitals, srilankan-universities, srilankan-universities, uk-mobile-number-validator, uk-post-code, and websmslk.
A total of 583 malicious YAML workflow files were deployed across these versions.
Workflows use GitHub-hosted runners to download a Linux payload from C2 server 43.228.157[.]68.
The payload targets cPanel and WebHost Manager (WHM) instances via CVE-2026-41940.
CVE-2026-41940 is an authentication bypass vulnerability.
Stolen data includes AWS credentials, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe keys, SendGrid/Mailgun credentials, and SSH material.
Approximately 6,100 workflow files on GitHub contain the DNSHook identifier "f5b0b742-240a-4811-8a5b-b0ba6060685d".
"Operation Muck and Load" involves 200 repositories across 190 accounts delivering Windows-based malware.
The "Water Curse" threat cluster, associated with "ischhfd83@rambler[.]ru", utilizes GitHub-based ghost networks.
Executive Summary
A sophisticated exploitation campaign has weaponized GitHub Actions to target cPanel and WebHost Manager (WHM) servers. By compromising the account of a PHP and DevOps developer, attackers inserted malicious workflows into ten Packagist packages. Unlike traditional supply chain attacks, the malicious code does not execute on the user's system; instead, it leverages GitHub's own hosted infrastructure to scan for and exploit CVE-2026-41940, an authentication bypass vulnerability. Once access is gained, the actors harvest a wide array of high-value secrets, including cloud keys, database credentials, and payment service tokens.
Concurrent activity, identified as Operation Muck and Load, utilizes a broader network of 200 repositories to distribute Windows malware via multi-stage downloaders. These operations appear linked to the "Water Curse" threat cluster. While the specific method of the initial account compromise remains unknown, the scale of the activity—evidenced by thousands of files sharing a unique DNSHook identifier—suggests a highly organized, opportunistic effort to monetize stolen server-side credentials.
Full Take
The strongest version of this narrative is that GitHub has shifted from being a mere hosting site to a programmable execution engine, and threat actors are now using that engine to launch "serverless" attacks. By moving the attack logic into GitHub Actions, the adversaries bypass the need to trick a user into installing a package, instead turning the developer's own trusted CI/CD pipeline into a weaponized scanning bot.
The root cause here is the erosion of the "trusted developer" paradigm. We assume that a repository's identity is a proxy for the code's integrity. This campaign exploits that trust, treating the GitHub ecosystem as a ghost network for staging and redirection. It echoes the historical pattern of "Living off the Land" (LotL), but scaled to the cloud: "Living off the Platform."
The implications are sobering for human agency in DevOps. When the infrastructure used to verify and deploy code becomes the primary vector for exploitation, the cost of trust increases. The benefit accrues to the attackers, who gain massive scalability with minimal footprint, while the cost is borne by server administrators and the general integrity of open-source distribution.
Patterns detected: none
The hypothetical playbook for an influence campaign using this data would involve amplifying the "danger" of open-source dependencies to push a proprietary, "closed-loop" security product. The actual content avoids this, focusing on the technical mechanism of the bypass rather than a call to abandon open-source tools.
Bridge Questions:
1. If the "execution path" is no longer the package itself, how must our definition of "malicious package" evolve to protect users?
2. Does the reliance on third-party runners for CI/CD create a systemic vulnerability that cannot be patched by individual developers?
3. To what extent does the automation of dependency synchronization (like Packagist) accelerate the spread of compromised infrastructure?
Sentinel — Human
The text presents highly specific technical details attributed to named researchers, suggesting it is derived from actual security research or detailed reporting, though verification of future dates is impossible without external context.