A new, large-scale campaign has been identified where attackers are weaponizing legitimate **GitHub** repositories to create a distributed attack network. This infrastructure is then used to scan for and exploit vulnerable **cPanel** and **WHM** servers.  The campaign involves malicious **Packagist** development versions across ten packages belonging to a legitimate PHP and DevOps developer, **dinushchathurya**. This activity was observed between July 12 and 13, 2026. The affected **Packagist** packages include: * dinushchathurya/nationality-list * dinushchathurya/srilankan-divisional-secretariats * dinushchathurya/srilankan-gn-divisions * dinushchathurya/srilankan-local-authorities * dinushchathurya/srilankan-mobile-number-validator * dinushchathurya/srilankan-state-hospitals * dinushchathurya/srilankan-universities * dinushchathurya/uk-mobile-number-validator * dinushchathurya/uk-post-code * dinushchathurya/websmslk **Socket** researchers clarified that the PHP libraries themselves were not the point of execution. Instead, attackers injected dozens of malicious **GitHub Actions** workflows into the compromised maintainer's source repositories. ### Exploiting CVE-2026-41940 These malicious workflows, once triggered by a repository push or manual execution, initiate **GitHub**-hosted runners. These runners download a Linux payload from attacker-controlled infrastructure and then scan for **cPanel** and **WHM** servers vulnerable to **CVE-2026-41940**. This authentication bypass vulnerability allows remote attackers to gain elevated control over the control panel.  The payload attempts an authentication bypass, followed by a comprehensive data harvesting operation. It targets credentials, configuration files, environment variables, database access information, SSH material, **Git** tokens, cloud keys, payment service credentials, and other valuable secrets. The specific method used by the threat actor to gain unauthorized access to the developer's account and push these malicious changes is currently unknown. ### The Mechanics of the Attack **Socket** researcher **Kirill Boychenko** explained that between July 12 and 13, 2026, **Packagist** automatically synchronized malicious development versions across all ten packages. This reflected the malicious changes pushed to the developer's **GitHub** repositories. Each affected development version contained between 55 and 62 malicious **GitHub Actions** workflow files, totaling 583 files across all ten package versions. These **YAML** automation files launch **GitHub**-hosted runners upon a repository push or manual execution. They detect the runner's processor architecture (e.g., 32-bit x86, 64-bit x86, 32-bit ARM, and 64-bit ARM) and download a compatible Linux scanning and exploitation payload from the command and control (C2) server at `43.228.157[.]68`. "The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests," **Boychenko** added. "The output files they monitor include **AWS** credentials, **GitHub** and **GitLab** tokens, **OpenAI** and **Google API** credentials, **Stripe** keys, **SendGrid** and **Mailgun** credentials, database information, **SSH** data, **Git** remotes, and remote code execution results." ### A Novel Exploitation Approach Unlike traditional malicious package campaigns that rely on user systems for execution, this activity uniquely abuses **GitHub Actions**. The scanning and exploitation occur on **GitHub**-hosted runners launched from compromised repositories, effectively turning **GitHub Actions** into an exploitation engine targeting vulnerable **cPanel** and **WHM** servers. Evidence suggests this is part of a broader campaign, with approximately 6,100 workflow files on **GitHub** containing a unique **DNSHook** identifier (`f5b0b742-240a-4811-8a5b-b0ba6060685d`).  **Socket** characterizes this campaign as an "opportunistic server-side credential theft operation." The stolen data can be used for subsequent compromises or monetization. ### Connection to Operation Muck and Load This disclosure follows **Socket**'s recent detailing of **Operation Muck and Load**, a campaign that abuses a network of 200 **GitHub** repositories across 190 accounts to deliver Windows-based malware. This malware includes information stealers, loaders, downloaders, droppers, spyware, remote access trojans, and **Monero** cryptocurrency miners. These repositories, some disguised as developer utilities or cryptocurrency wallet integrations, conceal a multi-stage attack chain. This chain downloads a **PowerShell** script that queries various dead drop sites like **Pastebin**, **Rlim**, **Telegram**, **YouTube**, **Instagram**, **Google Docs**, and **Gitcode** to retrieve a **GitHub**-hosted password-protected archive. The main payload is then extracted and launched from this archive. "The **GitHub** repositories in this cluster were not only lures," **Boychenko** noted. "Several also functioned as malware-bearing repositories, embedding malicious payloads directly in the source tree or delivering them through **GitHub** release assets." This activity shows tactical overlaps with previously observed activity linked to the "ischhfd83@rambler[.]ru" email address, tracked as **Water Curse** by **Trend Micro**. This threat cluster is known for operating a **GitHub**-based ghost network to redirect unsuspecting users to **GitHub** pages hosting malware-laced payloads. "This model gives threat actors a scalable way to turn ordinary software discovery into malware staging, especially when the lures target users already inclined to run untrusted tools, such as crypto automation, wallet utilities, game cheats, crypters, and offensive tooling," **Socket** concluded.