Listen to this Post
Introduction: When Trusted Code Repositories Become Silent Attack Machines
GitHub has long been considered one of the most trusted foundations of modern software development. Millions of developers depend on open-source repositories, automation workflows, and package ecosystems every day. But the same trust that makes these platforms powerful also makes them attractive targets for cybercriminals.
A newly uncovered campaign reveals a disturbing evolution in supply chain attacks. Instead of simply publishing malicious packages that infect developers who install them, threat actors compromised legitimate GitHub repositories and transformed GitHub Actions infrastructure itself into a distributed attack network.
The attackers abused compromised developer accounts, poisoned Packagist development releases, and deployed hundreds of malicious workflow files capable of launching cloud-based runners to scan the internet for vulnerable cPanel and WebHost Manager (WHM) servers. Their goal was not only exploitation, but also large-scale credential theft, collecting everything from SSH keys and database passwords to cloud API tokens and payment service credentials.
This campaign highlights a growing reality in cybersecurity: attackers are no longer just targeting software users. They are attacking the systems that build, distribute, and automate software itself.
The Discovery of a New GitHub-Based Attack Campaign
Cybersecurity researchers uncovered a sophisticated operation involving ten malicious development versions of PHP packages connected to a legitimate developer account named dinushchathurya.
The affected packages were hosted on Packagist, the primary PHP package repository used by thousands of developers. Between July 12 and July 13, 2026, malicious updates were automatically synchronized from compromised GitHub repositories into Packagist.
The affected packages included:
dinushchathurya/nationality-list
dinushchathurya/srilankan-divisional-secretariats
dinushchathurya/srilankan-gn-divisions
dinushchathurya/srilankan-local-authorities
dinushchathurya/srilankan-mobile-number-validator
dinushchathurya/srilankan-state-hospitals
dinushchathurya/srilankan-universities
dinushchathurya/uk-mobile-number-validator
dinushchathurya/uk-post-code
dinushchathurya/websmslk
However, researchers emphasized that the PHP packages themselves were not the main infection mechanism.
The real weapon was hidden inside GitHub Actions workflows.
GitHub Actions Abused as a Distributed Attack Platform
According to security researchers, attackers inserted dozens of malicious YAML workflow files into compromised repositories.
These workflows were designed to automatically execute whenever:
A repository received a new push
A workflow was manually triggered
GitHub Actions runners became available
Instead of infecting users who downloaded the packages, the attackers used GitHub’s own infrastructure as a free cloud-based attack platform.
The compromised repositories effectively became launch points for automated exploitation campaigns.
Each malicious workflow instructed GitHub-hosted runners to:
Detect the
Download a compatible Linux payload.
Contact attacker-controlled infrastructure.
Scan external targets.
Exploit vulnerable cPanel and WHM servers.
Upload stolen information back to the attackers.
This represents a major shift in supply chain abuse because the attack execution occurs inside trusted development infrastructure.
Exploiting CVE-2026-41940 Against cPanel and WHM Servers
The malicious payload focused on servers vulnerable to CVE-2026-41940, a critical authentication bypass vulnerability affecting cPanel and WHM environments.
The flaw allows remote attackers to bypass authentication protections and potentially gain elevated access to affected systems.
Once access was obtained, the malware attempted to collect sensitive information including:
Administrator credentials
Configuration files
Environment variables
Database credentials
SSH keys
GitHub tokens
GitLab tokens
Cloud service credentials
Payment platform secrets
API keys
The attackers were not simply compromising servers. They were harvesting everything needed to continue expanding their access.
Hundreds of Malicious Workflows Hidden Inside Developer Repositories
The scale of the operation was significant.
Researchers discovered that each compromised package version contained between 55 and 62 malicious GitHub Actions workflow files.
Across the ten affected packages, the total number reached approximately 583 malicious workflow files.
These workflows contained automation logic designed to:
Launch cloud runners
Identify system architecture
Download attack tools
Communicate with command-and-control servers
Report execution results
Upload stolen credentials
The attacker-controlled infrastructure included a command server used to distribute Linux payloads and collect stolen information.
The Mystery Behind the Initial Account Compromise
One of the biggest unanswered questions remains how the attacker gained access to the legitimate developer’s GitHub account.
Researchers have not confirmed whether the compromise occurred through:
Stolen credentials
Token theft
Malware infection
Social engineering
Weak account security settings
Third-party application compromise
Understanding the initial intrusion method is critical because developer accounts have become high-value targets.
A compromised developer account can provide attackers with access to:
Source code
Release pipelines
Package repositories
CI/CD infrastructure
Millions of downstream users
Credential Theft as the Main Objective
The campaign appears to be designed around opportunistic credential harvesting.
Researchers found that stolen data could include:
AWS credentials
OpenAI API keys
Google API credentials
Stripe payment keys
SendGrid credentials
Mailgun credentials
Database access information
SSH authentication material
Git repository tokens
These secrets can provide attackers with multiple monetization paths.
They may:
Sell stolen credentials on underground markets.
Launch ransomware attacks.
Hijack cloud environments.
Steal cryptocurrency.
Conduct business email compromise campaigns.
Access private corporate systems.
The attackers effectively turned vulnerable servers into treasure maps containing valuable digital keys.
A Wider GitHub Ghost Network Behind the Operation
Researchers believe this campaign is not limited to a single compromised developer.
Evidence suggests a larger network involving approximately 6,100 GitHub workflow files containing a unique DNSHook identifier:
f5b0b742-240a-4811-8a5b-b0ba6060685d
This indicates a broader infrastructure designed to coordinate malicious automation at scale.
GitHub repositories are increasingly becoming attractive to threat actors because they provide:
Reputation
Free hosting
Developer trust
Automated execution
Global reach
Attackers can hide malicious operations inside legitimate-looking projects while avoiding traditional security controls.
Operation Muck and Load: Another GitHub Malware Campaign
The discovery follows another campaign tracked as Operation Muck and Load, where attackers abused around 200 GitHub repositories across approximately 190 accounts.
That campaign focused on delivering Windows malware including:
Information stealers
Loaders
Downloaders
Remote access trojans
Spyware
Cryptocurrency miners
Some repositories disguised themselves as:
Developer utilities
Cryptocurrency wallet tools
Gaming modifications
Offensive security tools
The repositories used multi-stage infection chains involving PowerShell scripts and external hosting services.
Attackers used platforms such as:
Pastebin
Telegram
YouTube
Google Docs
Gitcode
to distribute malicious payloads.
Why GitHub Has Become a Prime Target for Threat Actors
GitHub’s popularity creates a unique security challenge.
Traditional malware campaigns often depend on convincing victims to download suspicious files.
Modern attackers increasingly prefer abusing trusted ecosystems.
A malicious GitHub repository can appear legitimate because:
It contains normal-looking source code.
It has developer activity.
It uses official automation systems.
It benefits from
This makes detection harder.
The battlefield has moved from individual computers toward the software supply chain itself.
Deep Analysis: How Security Teams Can Investigate Similar Attacks
Detect Suspicious GitHub Actions Workflows
Security teams should regularly audit workflow files:
find .github/workflows -type f -name ".yml"
Search for suspicious commands:
grep -R "curl|wget|bash|chmod +x" .github/workflows/
Monitor Unexpected Network Connections
Analyze outbound traffic from CI/CD environments:
sudo tcpdump -i eth0 host 43.228.157.68
Check active connections:
netstat -tulpn
Search Systems for Exposed Secrets
Look for leaked credentials:
grep -R "AWS_SECRET|API_KEY|TOKEN" /
Scan Git history:
git log --all --stat
Audit GitHub Repository Permissions
Review repository access:
gh repo view --json collaborators
Check active workflows:
gh workflow list
Monitor cPanel Server Security
Review authentication logs:
grep "failed password" /var/log/auth.log
Check suspicious processes:
ps aux --sort=-%cpu
Search unusual files:
find /tmp -type f -mtime -1 Protect CI/CD Infrastructure
Organizations should:
Enable multi-factor authentication.
Rotate API credentials regularly.
Restrict GitHub Actions permissions.
Require code reviews for workflow changes.
Disable unnecessary workflow execution.
Monitor package publishing activity.
CI/CD systems should be treated as production infrastructure, not simple developer tools.
What Undercode Say:
The latest GitHub abuse campaign demonstrates a dangerous transformation in cybercrime strategy.
Attackers are no longer satisfied with compromising individual machines.
They are targeting trust relationships.
A developer account represents a bridge between code creators and thousands of users.
When attackers compromise that bridge, they gain access to an ecosystem rather than a single device.
The abuse of GitHub Actions is especially concerning because cloud automation systems provide attackers with legitimate computing resources.
The threat actor did not need to build expensive infrastructure.
GitHub runners provided temporary machines capable of scanning and attacking targets worldwide.
This reduces the cost of cybercrime.
The campaign also shows how software supply chain attacks continue evolving.
Previous attacks focused on malicious packages.
Modern attacks increasingly focus on the systems behind those packages.
The difference is important.
A malicious package attacks consumers.
A compromised development pipeline attacks everyone connected to the ecosystem.
The stolen credentials represent another major concern.
API keys, cloud credentials, and SSH tokens are often more valuable than traditional malware infections.
A single exposed AWS key can lead to massive cloud compromise.
A stolen GitHub token can allow attackers to inject malicious code into trusted projects.
A leaked payment credential can create direct financial losses.
Organizations must rethink their security assumptions.
Open-source software cannot be trusted only because it appears popular.
Repository activity, workflow changes, and contributor behavior must be continuously monitored.
Security teams should treat GitHub Actions as executable infrastructure.
Every workflow file is effectively code running with permissions.
The same security principles applied to servers must apply to automation pipelines.
Developers should avoid storing secrets inside repositories.
Organizations should use secret management systems.
Continuous monitoring should detect unusual workflow creation.
Unexpected package releases should trigger investigation.
The future of cybersecurity will involve defending not only computers but also the invisible systems that create software.
Attackers understand this shift.
Security teams must adapt before supply chain attacks become even more automated.
✅ The campaign involved compromised GitHub repositories and malicious GitHub Actions workflows used for exploitation.
✅ Researchers confirmed malicious Packagist development versions linked to compromised repositories.
✅ The operation targeted credential theft and vulnerable cPanel/WHM servers.
Prediction
(+1)
Cloud-based CI/CD abuse will continue increasing as attackers discover automation platforms provide scalable attack infrastructure.
More organizations will adopt stronger GitHub security controls, including workflow monitoring and mandatory identity protection.
Software supply chain security will become a central priority for enterprises.
Smaller open-source projects may remain vulnerable because they often lack dedicated security resources.
Final Thoughts: The New Battle for Software Trust
The GitHub campaign represents a warning for the entire technology ecosystem.
The future of cyber defense will not only depend on protecting servers and endpoints.
It will depend on protecting the software creation process itself.
As attackers continue transforming trusted platforms into weapons, developers, companies, and security researchers must work together to secure the foundations of modern digital infrastructure.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
