"The PHP libraries were not the execution path," Socket said in a statement.
How GitHub Actions workflows were weaponized
Socket's analysis shows attackers added dozens of malicious GitHub Actions workflows to compromised source repositories. The YAML automation files launch GitHub-hosted runners when a repository receives a push or when a workflow is manually started, detect each runner's processor architecture (32-bit x86, 64-bit x86, 32-bit ARM, 64-bit ARM), and download a compatible Linux scanning and exploitation payload from command-and-control infrastructure at 43.228.157[.]68. The workflows continuously report execution status to the threat actor and upload newly collected results through HTTP POST requests, according to Socket researcher Kirill Boychenko.
Targeting cPanel and WHM with CVE-2026-41940
Once executed on a GitHub-hosted runner, the downloaded payload scans for cPanel and WebHost Manager (WHM) instances susceptible to CVE-2026-41940, an authentication bypass vulnerability that allows remote attackers to gain elevated control of the control panel. The payload attempts an authentication bypass and then proceeds to harvest a broad set of secrets and configuration material, including credentials, configuration files, environment variables, database access, SSH material, Git tokens, cloud keys, payment service credentials and other valuable secrets.
Compromised Packagist packages and the scale of injected workflows
Between July 12 and 13, 2026, Packagist automatically synchronized malicious development versions across ten packages associated with the PHP and DevOps developer account dinushchathurya. The affected Packagist packages are:
- dinushchathurya/nationality-list
- dinushchathurya/srilankan-divisional-secretariats
- dinushchathurya/srilankan-gn-divisions
- dinushchathurya/srilankan-local-authorities
- dinushchathurya/srilankan-mobile-number-validator
- dinushchathurya/srilankan-state-hospitals
- dinushchathurya/srilankan-universities
- dinushchathurya/uk-mobile-number-validator
- dinushchathurya/uk-post-code
- dinushchathurya/websmslk
- Technologists and security teams: the campaign demonstrates abuse of GitHub-hosted runners as a distributed scanning and exploitation platform rather than targeting package consumers. Socket flagged roughly 6,100 workflow files on GitHub containing a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d"), a signal defenders can use when hunting for related activity.
- Open-source maintainers and repository owners: Socket's findings show how unauthorized workflow files can turn a project's CI/CD into an attack surface. The disclosure notes the exact method by which the threat actor gained access to the developer's account and pushed malicious changes remains unclear, underlining the importance of auditing workflows and repository settings after any suspicious commits or pushes.
- Hosting providers and cPanel/WHM operators: the campaign explicitly hunts for servers vulnerable to CVE-2026-41940. Operators need to be aware that scanned and exploited targets may face extensive credential and secret exfiltration if an authentication bypass succeeds.
Each compromised development version contained between 55 and 62 malicious workflow files, totaling 583 workflow files across the ten package versions.
Operation Muck and Load, and a GitHub-based ghost network
Socket disclosed a related cluster it calls Operation Muck and Load: a network of roughly 200 GitHub repositories across 190 accounts used to deliver Windows-based malware. Those repositories delivered information stealers, loaders and downloaders, droppers, spyware, remote access trojans and Monero cryptocurrency miners. The attack chain often uses a multi-stage approach: a PowerShell script queries dead-drop sites such as Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs and Gitcode to fetch a GitHub-hosted, password-protected archive; the archive then yields the main payload.
Socket said some repositories masqueraded as developer utilities and cryptocurrency wallet integrations; several also functioned as malware-bearing repositories that embedded malicious payloads directly in the source tree or delivered them through GitHub release assets. The activity shares tactical overlaps with previously observed activity associated with the "ischhfd83@rambler[.]ru" email address, which has been tracked under the moniker Water Curse by Trend Micro. Socket assessed the cluster operates a GitHub-based ghost network to redirect unsuspecting users to GitHub pages hosting malware-laced payloads.
Socket characterized the broader effort as an "opportunistic server-side credential theft operation" that lets attackers leverage stolen data for follow-on compromises or monetization.
What this means for technologists, open-source maintainers, and hosting providers
Attackers in this campaign shifted the locus of exploitation from package consumers' systems to CI infrastructure itself. That operational pivot — weaponizing GitHub Actions runners to run remote scanning and theft routines tied to a known cPanel/WHM vulnerability, and linking it to a wider set of GitHub-hosted malware repositories — leaves one central question from Socket's disclosure unanswered: how the initial GitHub account compromises were achieved. The answer will determine whether defenses should focus first on repository hygiene, runner restrictions, identity controls, or external supply-chain monitoring.
https://thehackernews.com/2026/07/attackers-weaponize-github-actions.html
