Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Summary

Attackers are weaponizing compromised GitHub repositories to target cPanel and WHM servers using malicious workflows. These workflows exploit CVE-2026-41940 to steal credentials and sensitive data. The campaign appears to be broader than initially identified, with numerous workflow files exhibiting similar characteristics.

Key Takeaways

1. Attackers have weaponized compromised GitHub repositories to create distributed attack infrastructure targeting cPanel and WHM servers.
2. Malicious GitHub Actions workflows are used to launch runners, download Linux payloads, and scan for servers vulnerable to CVE-2026-41940, an authentication bypass vulnerability.
3. The campaign involves stealing credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, and payment service credentials.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents detailed technical information about a cybersecurity threat, citing specific vulnerabilities and attack vectors. It attributes findings to cybersecurity researchers, enhancing its credibility. However, the exact method of account compromise remains unclear, introducing a minor uncertainty.

Bias assessment: Technical Reporting. The article focuses on reporting technical details of a cyberattack with minimal subjective commentary. It aims to inform about a security threat rather than promote a specific agenda. The language is objective and descriptive of the observed malicious activity.

Note: This article details a sophisticated cyberattack. While technically informative, users should cross-reference specific vulnerability claims and threat actor attribution with other security advisories.

Credibility flag: Technical, Verify Details

Claimed Facts (8)

• This is a factual statement about the discovery and nature of the campaign.
• This provides specific details about the affected packages and the timeframe of the malicious activity.
• This is a factual statement about the role of the PHP libraries in the attack chain.
• This describes the specific malicious components introduced into the repositories.
• This details the operational flow and technical execution of the attack.
• This describes the actions performed by the downloaded payload.
• This explains how the malicious code was distributed through Packagist.
• This quantifies the extent of the malicious files introduced.

Opinions (7)

• This statement acknowledges an unknown aspect of the attack, indicating a lack of definitive information rather than a subjective viewpoint.
• The phrase 'Signs point to' suggests an interpretation of evidence rather than a definitively proven fact.
• This is a description of the campaign's nature as interpreted by Socket, which is an opinion on the attacker's motives and strategy.
• While reporting on another campaign, the framing and codename suggest a narrative construction by the reporting entity.
• The term 'masquerade' implies an interpretation of the repositories' intent, which is an opinion.
• The phrase 'shares tactical overlaps' and the use of a moniker ('Water Curse') indicate an analytical interpretation by Trend Micro.
• The term 'assessed' indicates an evaluation or judgment by the reporting entity.

Claims (2)

• While plausible, the claim of 'continuously report' and the specific method of 'HTTP POST requests' are detailed technical assertions that, without direct observation or proof, could be speculative.
• This statement is a broad generalization about threat actor motivations and capabilities, presented as a definitive observation without specific evidence for this particular campaign's success in this regard.

Key Sources

• The Hacker News — Media
• Socket — Cybersecurity Research Firm
• Kirill Boychenko — Socket Researcher
• dinushchathurya — PHP and DevOps Developer
• Trend Micro — Cybersecurity Firm