Large-Scale Cyber Campaign Hijacks GitHub Actions to Target Web Hosting Servers A sophisticated cyber campaign is exploiting GitHub Actions to weaponize trusted open-source projects, turning them into tools for scanning and compromising web hosting servers. The attack, uncovered by analysts at Socket.dev, abuses free GitHub compute resources to target cPanel and WHM servers critical infrastructure for managing websites, email accounts, and databases. Between July 12 and 13, 2026, attackers compromised a legitimate PHP developer’s Packagist account, injecting malicious GitHub Actions workflow files into ten development versions of their packages. These workflows, containing 55–62 malicious files each, launch temporary Ubuntu runners that download Linux payloads and scan the internet for vulnerable hosts. The campaign extends beyond the initial compromise, with thousands of matching workflow files discovered across unrelated repositories, indicating a broad effort to hijack automation pipelines. The attack chain begins when a compromised repository triggers a workflow, spinning up an ephemeral GitHub runner. The runner fetches a processor-specific payload from a threat actor-controlled server (43.228.157.68) and exploits CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. Successful breaches expose cloud credentials, payment data, and source control tokens including AWS keys, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe credentials, and SSH material. The malware exfiltrates stolen data in small chunks via HTTP POST requests, with heartbeats sent every 30 seconds. While installing the affected PHP packages does not directly execute the malware, root-level GitHub Actions in compromised repositories serve as the attack engine. A single WHM compromise can jeopardize multiple customer accounts, databases, and application secrets. The campaign remains active despite the suspension of one GitHub account, underscoring its persistence. Indicators of compromise include the C2 server IP (43.228.157.68), payload delivery URLs, and the compromised maintainer account (dinushchathurya). Affected Packagist packages span multiple repositories, all tied to the same developer. Defensive measures include disabling suspicious workflows, rotating credentials, and patching cPanel/WHM systems. The incident highlights the risks of untrusted automation in CI/CD pipelines, echoing past supply chain attacks where stolen credentials enabled further breaches.