Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
A sophisticated campaign leveraging compromised GitHub repositories is targeting cPanel and WHM servers. Attackers are using malicious GitHub Actions workflows to launch GitHub-hosted runners that scan for vulnerable servers and steal credentials, including AWS credentials, API keys, and SSH material. The campaign utilizes a network of GitHub repositories to host malware and employs a ‘ghost network’ to deliver malicious payloads, mirroring tactics used by the Water Curse threat actor. This represents a significant escalation in GitHub-based malware delivery.
A large-scale campaign targeting cPanel and WebHost Manager (WHM) servers is underway, utilizing compromised GitHub repositories to deliver a sophisticated malware campaign. The attackers are exploiting a vulnerability – CVE-2026-41940 – through malicious GitHub Actions workflows. These workflows, triggered by repository pushes or manual runs, launch GitHub-hosted runners that then download a Linux payload from attacker-controlled infrastructure. This payload attempts an authentication bypass and subsequently harvests sensitive data, including AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results.
The campaign’s unique aspect is its reliance on GitHub-hosted runners, effectively abusing the platform’s infrastructure to conduct server scanning and credential theft. The malicious workflows, totaling 583 files across ten packages, continuously report execution status and upload collected results via HTTP POST requests. The activity is linked to a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d"), and shares tactical overlaps with previously observed activity associated with the "ischhfd83@rambler[.]ru" email address, tracked as Water Curse by Trend Micro. The threat actors are utilizing a ‘ghost network’ – a cluster of GitHub repositories – to deliver malware-laced payloads, often disguised as developer utilities and cryptocurrency wallet integrations. This model allows threat actors to transform software discovery into malware staging, particularly targeting users already inclined to use untrusted tools such as crypto automation and wallet utilities.