admin The campaign uses GitHub-hosted computing systems as disposable machines for scanning the internet, exploiting vulnerable hosting platforms and transmitting stolen information to attacker-controlled infrastructure. Security researchers linked the activity to malicious workflow files planted in thousands of repositories.
The investigation began with suspicious development versions of 10 PHP packages on Packagist, a repository used by developers working with the Composer dependency manager. The packages belonged to a legitimate PHP and DevOps developer whose associated GitHub repositories had been compromised.
Between July 12 and 13, attacker-controlled changes were automatically synchronised from GitHub to the packages’ development branches. Analysts found 583 malicious GitHub Actions workflow files across the 10 versions, with each package containing between 55 and 62 files.
The underlying PHP libraries did not contain malicious installation scripts or code designed to run on users’ computers. Instead, the attack instructions were concealed within the repositories’. github/workflows directories, which control automated development and deployment tasks.
Installing the affected packages through Packagist would not ordinarily activate the malicious files because GitHub does not execute workflow definitions nested inside a project’s dependency directory. The workflows were triggered when changes were pushed to the compromised source repositories or when an attacker launched them manually.
Each workflow instructed GitHub to create a temporary Ubuntu-based runner. These virtual machines, normally used to test software or automate releases, were converted into short-lived attack nodes with internet access.
The workflows identified the processor architecture of each runner and downloaded a matching Linux executable from an external server. Separate payloads were available for 32-bit and 64-bit x86 systems, as well as ARM and ARM64 environments.
Once launched, the software scanned internet-facing systems on ports commonly used by websites and hosting control panels. Its main target was CVE-2026-41940, an authentication bypass vulnerability affecting cPanel and WHM deployments.
cPanel allows customers to manage websites, databases, email accounts and configuration files. WHM gives hosting administrators broader control over servers and multiple cPanel accounts. A successful WHM compromise can therefore expose numerous websites and customer environments through a single intrusion.
The payload searched breached servers for Amazon Web Services keys, GitHub and GitLab access tokens, database passwords, SSH credentials and environment files. It also sought OpenAI and Google API credentials, Stripe payment keys and tokens linked to email services such as SendGrid and Mailgun.
Stolen source-control credentials could allow the attackers to enter more repositories, implant additional workflows and expand the operation. This creates a self-reinforcing supply-chain threat in which credentials obtained from hosting servers can be used to compromise development infrastructure.
The workflows maintained constant contact with the command-and-control server. A heartbeat mechanism reported their status every 30 seconds, identifying the repository and sending the latest scanning activity to the operators.
Collected data was uploaded in batches through repeated web requests. The system tracked which information had already been transmitted, allowing it to send new credentials and exploitation results without duplicating earlier material. A final collection process operated even when the scanner stopped unexpectedly.
Researchers identified a distinctive DNS callback used to verify that commands had executed. Searches for that marker found about 6,100 matching workflow files across unrelated GitHub repositories. Broader searches involving the payload server, scanning instructions and data-exfiltration code returned between 15,000 and 16,000 matching files.
Those figures do not represent an equal number of confirmed victims. A repository can contain several copies of the workflow, while some accounts may have been created or controlled directly by the attackers. The repeated code across projects with unrelated development histories nevertheless indicates a campaign extending well beyond the original PHP packages.
GitHub suspended the account linked to the Packagist packages, disrupting one route used by the operators. Matching workflows may still remain in forks, mirrors, cached repositories and other compromised accounts, while exposed servers and stolen credentials could continue to support further attacks.
Repository owners have been urged to inspect workflow directories, disable unauthorised automation and preserve GitHub Actions logs for investigation. Credentials, access tokens and application secrets connected to affected systems should be replaced.
