Actor Profile

This campaign represents an unattributed threat operation leveraging compromised GitHub infrastructure for distributed server exploitation. The actor compromised the GitHub account of a legitimate PHP developer (dinushchathurya) between July 12-13, 2026, injecting malicious GitHub Actions workflows into 10 Packagist packages. The attacker's motivation centers on opportunistic server-side credential theft targeting cPanel and WHM instances vulnerable to CVE-2026-41940. The campaign demonstrates sophisticated understanding of CI/CD abuse, supply chain positioning, and automated credential harvesting. A unique DNSHook identifier (f5b0b742-240a-4811-8a5b-b0ba6060685d) appears in approximately 6,100 workflow files across GitHub, suggesting this extends beyond a single compromised maintainer to a broader, coordinated operation. The exact initial access vector to the developer's account remains unknown.

TTPs (Tactics, Techniques, Procedures)

The campaign employs GitHub Actions abuse as distributed attack infrastructure. Malicious YAML workflow files (583 total across 10 packages) trigger GitHub-hosted runners via repository push events or manual execution. Runners detect processor architecture (x86/ARM, 32/64-bit) and download architecture-specific Linux payloads from C2 infrastructure at 43.228.157[.]68. The payload exploits CVE-2026-41940, an authentication bypass vulnerability in cPanel/WHM, to gain elevated control panel access. Post-exploitation activities include credential harvesting (AWS, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe, SendGrid, Mailgun), configuration file theft, environment variable extraction, database access credentials, SSH material, Git tokens, cloud keys, and payment service credentials. Exfiltration occurs via HTTP POST requests to attacker infrastructure. Key techniques align with T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools), T1078 (Valid Accounts), T1552.001 (Unsecured Credentials: Credentials In Files), T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage), and T1190 (Exploit Public-Facing Application).

Targets & Patterns

Primary targets are web hosting providers, software development organizations, and DevOps environments running cPanel and WebHost Manager (WHM) instances vulnerable to CVE-2026-41940. The campaign specifically hunts for servers with this authentication bypass vulnerability, enabling remote attackers to gain elevated control panel access. Secondary targeting includes developers and organizations consuming the 10 compromised Packagist PHP packages, though the attack execution path bypasses package users' systems entirely—exploitation runs on GitHub's infrastructure rather than downstream consumers. The attacker prioritizes high-value credential theft including cloud provider keys (AWS), version control tokens (GitHub/GitLab), API credentials (OpenAI, Google), payment processors (Stripe), email services (SendGrid, Mailgun), and database/SSH access. This targeting pattern suggests monetization through follow-on access sales, direct financial fraud via payment credentials, or establishing persistent access to hosting infrastructure for further campaigns.

Historical Context

Socket researchers identify tactical overlaps with activity tracked as Water Curse by Trend Micro, associated with the email address "ischhfd83@rambler[.]ru". Water Curse operates a GitHub-based ghost network redirecting users to malware-hosting GitHub pages. The current campaign shares infrastructure abuse patterns but represents an evolution—rather than social engineering users to download malware, this operation weaponizes CI/CD pipelines for automated server exploitation. Socket also disclosed a concurrent campaign named Operation Muck and Load utilizing 200 GitHub repositories across 190 accounts to deliver Windows malware (stealers, loaders, RATs, Monero miners) via multi-stage chains querying dead drop sites (Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, Gitcode). The DNSHook identifier appearing in 6,100 workflow files suggests this cPanel/WHM campaign is part of a larger GitHub abuse ecosystem, though direct attribution linkage between these clusters remains unconfirmed.

Defensive Recommendations

  • Immediately patch cPanel and WHM instances against CVE-2026-41940 authentication bypass vulnerability; prioritize internet-facing control panels
  • Monitor GitHub Actions workflow executions for anomalous runner launches, especially workflows added outside normal development cycles or triggering on push events without code review
  • Implement GitHub repository protection rules requiring pull request reviews before workflow modifications; enable branch protection on default branches to prevent direct pushes
  • Detect credential exfiltration via HTTP POST requests from CI/CD environments (T1567.002); monitor egress traffic from GitHub Actions runners to non-standard destinations, particularly 43.228.157[.]68 and associated infrastructure
  • Audit Packagist and Composer dependencies for development versions from dinushchathurya namespace (nationality-list, srilankan-*, uk-mobile-number-validator, uk-post-code, websmslk); pin to known-good stable releases and review .github/workflows directories for malicious YAML files containing DNSHook identifier f5b0b742-240a-4811-8a5b-b0ba6060685d