Actor Profile

The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated understanding of GitHub Actions infrastructure and supply chain attack vectors. Motivation appears financially driven, focused on opportunistic server-side credential theft for follow-on compromises or monetization. The actor compromised the GitHub account of a legitimate PHP/DevOps developer (dinushchathurya) to inject malicious GitHub Actions workflows into 10 Packagist packages between July 12-13, 2026. The exact initial access method to the developer's account remains unclear. Tactical overlaps exist with activity tracked as Water Curse by Trend Micro, associated with email "ischhfd83@rambler[.]ru", suggesting possible connection to a broader GitHub-based ghost network operation.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages compromised GitHub repositories as distributed attack infrastructure. Malicious GitHub Actions workflows (583 YAML files across 10 packages) are triggered by repository push events or manual execution, launching GitHub-hosted runners that download architecture-specific Linux payloads from C2 server 43.228.157[.]68. The payloads scan for and exploit CVE-2026-41940, an authentication bypass vulnerability in cPanel/WHM servers. Post-exploitation activities include credential harvesting (AWS, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe, SendGrid, Mailgun), configuration file theft, environment variable extraction, database access credentials, SSH material, Git tokens, cloud keys, and payment service credentials. Results are exfiltrated via HTTP POST requests to attacker infrastructure. The attack uniquely abuses GitHub's compute resources rather than targeting package users' systems directly.

Targets & Patterns

Primary targets are web hosting providers and DevOps environments running cPanel and WebHost Manager (WHM) instances vulnerable to CVE-2026-41940. The campaign specifically targets server infrastructure rather than end-user systems, focusing on credential-rich environments containing cloud provider access keys, API tokens, payment processing credentials, and database access. The choice of compromising a PHP/DevOps developer's packages suggests targeting of the software development and web hosting supply chain. Approximately 6,100 workflow files containing a unique DNSHook identifier ("f5b0b742-240a-4811-8a5b-b0ba6060685d") indicate campaign scale extends beyond the single compromised maintainer, suggesting systematic targeting of GitHub-hosted development infrastructure across multiple accounts.

Historical Context

This campaign represents a novel evolution in supply chain attacks by weaponizing GitHub Actions compute infrastructure rather than traditional malicious package distribution. Socket researchers also identified a related campaign codenamed "Operation Muck and Load" utilizing 200 GitHub repositories across 190 accounts to deliver Windows malware (infostealers, loaders, RATs, Monero miners) through multi-stage chains leveraging dead drop sites (Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, Gitcode). Tactical overlaps link this activity to Water Curse threat cluster tracked by Trend Micro, associated with email "ischhfd83@rambler[.]ru", which operates GitHub-based ghost networks to redirect users to malware-hosting pages. This represents an escalation from previous GitHub abuse patterns, demonstrating threat actor adaptation to cloud-native development workflows.

Defensive Recommendations

  • Immediately patch cPanel/WHM instances against CVE-2026-41940 authentication bypass vulnerability and implement network segmentation to limit exposure of control panel interfaces
  • Monitor GitHub Actions workflow modifications in organizational repositories for unauthorized YAML files, particularly those containing external download commands, HTTP POST exfiltration, or references to unknown C2 infrastructure (IOC: 43.228.157[.]68)
  • Implement GitHub repository protection rules requiring code review for workflow file changes (.github/workflows/*.yml) and enable branch protection with required approvals for all production repositories
  • Hunt for DNSHook identifier 'f5b0b742-240a-4811-8a5b-b0ba6060685d' in GitHub Actions logs and audit Packagist/Composer dependencies for development versions of affected dinushchathurya packages published July 12-13, 2026
  • Deploy secrets scanning solutions to detect exposed credentials in GitHub repositories and rotate all API keys, cloud credentials, SSH keys, and tokens that may have been accessible to compromised GitHub Actions runners