Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

MITRE Techniques

• [T1195.001 ] Supply Chain Compromise: Compromise Software Dependencies and Development Tools – The attacker abused compromised repository content and Packagist synchronization to distribute malicious workflow files (‘Packagist automatically synchronized malicious development versions across all ten packages’).
• [T1584.006 ] Compromise Infrastructure: Web Services – The campaign relied on attacker-controlled web infrastructure for payload delivery and collection (‘download a corresponding Linux scanning and exploitation payload from the threat actor-controlled command and control server’).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The workflow executed Linux payloads and shell commands on GitHub-hosted runners (‘curl… wget… chmod 755 /tmp/.svc’).
• [T1105 ] Ingress Tool Transfer – The payload was downloaded from attacker infrastructure to the runner (‘download a corresponding Linux scanning and exploitation payload from 43[.]228[.]157[.]68’).
• [T1082 ] System Information Discovery – The payload detected runner processor architecture before selecting the correct binary (‘detect each runner’s processor architecture’).
• [T1496.002 ] Resource Hijacking: Bandwidth Hijacking – GitHub-hosted runners were used as disposable compute and network resources for attack operations (‘use their compute and internet connectivity to execute the payload, scan targets’).
• [T1595.002 ] Active Scanning: Vulnerability Scanning – The payload scanned broad internet-facing targets and searched for exposed services (‘scans a broad range of internet-facing systems’).
• [T1190 ] Exploit Public-Facing Application – The payload targeted cPanel and WHM and attempted to exploit CVE-2026-41940 (‘–exploit CVE-2026-41940’).
• [T1552.001 ] Unsecured Credentials: Credentials in Files – The payload searched for credentials, tokens, keys, and configuration data stored on servers (‘searches compromised servers for credentials, configuration files, environment variables’).
• [T1005 ] Data from Local System – Data was collected from compromised servers and runner outputs (‘searches compromised servers for… database access, SSH material’).
• [T1119 ] Automated Collection – The workflows continuously monitored result files and collected newly written data automatically (‘monitors files containing exploitation results… uploads newly written content’).
• [T1074.001 ] Data Staged: Local Data Staging – Results were buffered and uploaded in chunks, with offsets tracked to avoid duplicates (‘uploads newly collected results through HTTP POST requests’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Heartbeats and results were sent over HTTP POST (‘curl -s -X POST “$PANEL/api/github-heartbeat”‘).
• [T1071.004 ] Application Layer Protocol: DNS – DNS lookups were used as callbacks to confirm execution (‘nslookup … dnshook[.]site’).
• [T1020 ] Automated Exfiltration – Collected data was automatically sent back to attacker infrastructure in chunks (‘The workflow tracks line offsets… live collection transmits’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data and telemetry were sent to the command-and-control server (‘upload newly collected results through HTTP POST requests’).