Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers

Hackers are abusing compromised GitHub repositories and GitHub Actions workflows to build a de facto global botnet that scans and exploits web hosting servers, with a primary focus on cPanel and WHM deployments.

The campaign first surfaced when malicious development versions were discovered across ten Packagist PHP packages tied to a legitimate PHP and DevOps developer, dinushchathurya, whose upstream GitHub repositories had been compromised.

These branch-based dev versions synchronized attacker-controlled changes from GitHub but did not contain malicious PHP code: the libraries hold static reference data and normal lookup functions with no install hooks or runtime malware behavior.

The real attack logic lives under .github/workflows/, where the threat actor added between 55 and 62 GitHub Actions workflows per package, totaling 583 workflow files across all affected development versions.

Crucially, installing these Composer packages via Packagist does not automatically trigger the malicious workflows.

GitHub ignores nested workflow definitions inside a dependency’s vendor directory, and cloning the repository does not execute the payload locally on a maintainer’s workstation.

Execution occurs only when a compromised repository with .github/workflows at its root receives a push or when someone manually dispatches the workflows, at which point GitHub spins up ephemeral Ubuntu runners and hands control to attacker-supplied automation.

Each malicious workflow is configured to run on ubuntu-latest with extended timeouts and to fire on any branch push or manual trigger, effectively converting routine CI events into an exploitation launchpad.

Once invoked, the workflow detects the runner’s processor architecture and pulls down a matching Linux payload from the attacker-controlled server at 43[.]228[.]157[.]68 over HTTP, using redundant curl and wget logic and permissive execution flags.

Socket Researchers said that, the operation repurposes GitHub-hosted Ubuntu runners as disposable attack infrastructure for large-scale internet scanning, exploitation, and credential theft.

At the same time, Packagist PHP packages served mainly as an indicator of upstream compromise rather than the execution vector.

The server exposes distinct /api/dl/* paths for x86, x86_64, ARM, and ARM64 binaries, allowing the actor to swap or upgrade payloads without altering the on-repo workflows.

GitHub Actions Into a Global Botnet

The recovered AMD64 payload, with SHA-256 22f7…81f1, then runs an internet-scale scanner configured to exploit CVE-2026-41940 against exposed cPanel and WHM endpoints and to enumerate Git data, environment variables, configuration files, and secrets on compromised systems.

The output files they monitor include AWS credentials, GitHub and GitLab tokens, OpenAI and Google API credentials, Stripe keys, SendGrid and Mailgun credentials, database information, SSH data, Git remotes, and remote code execution results.

By abusing GitHub Actions in this way, the actor effectively hijacks GitHub’s CI/CD compute as a distributed scanning and exploitation fleet.

The runners operate as short-lived bots that probe ports commonly associated with web and hosting control-plane services, attempt authentication bypass against vulnerable cPanel/WHM instances.

Systematically harvest high-value credentials including cloud keys, payment processor tokens, email service API keys, database logins, SSH material, and source-control tokens that can be reused for further repository compromise and broader software supply chain impact.

The workflows implement a resilient command-and-control and exfiltration channel that continuously reports status and streams stolen data in chunks.

A heartbeat loop posts execution updates every 30 seconds to /api/github-heartbeat, identifying the repository and embedding the latest scanner log line so the attacker can monitor thousands of concurrent runners in near real time.

In parallel, the workflows tail output files that aggregate exploitation results and credentials, then issue repeated POST requests to /api/github-results.

Sending up to thousands of new lines per request while tracking offsets to avoid duplicate transmission, and ensuring final data collection even when the scanner fails or terminates early.

Investigation of the campaign’s unique DNSHook callback hostname queried from several recovered workflows to confirm command execution via DNS lookups provided a high-fidelity pivot into GitHub’s codebase.

A GitHub code search for this DNSHook identifier surfaced roughly 6,100 matching workflow files across unrelated repositories, while broader searches keyed on the C2 address, scanner arguments, credential filenames, heartbeat endpoint, and exfiltration logic returned on the order of 15,000–16,000 matching files.

These figures represent matched files rather than confirmed victim accounts, since a single repository may host many cloned workflows and some infrastructure is attacker-controlled staging rather than compromised projects.

Nonetheless, the distinctive, repeated code across unrelated repositories confirms a broad campaign that extends far beyond one PHP maintainer and weaponizes GitHub Actions as distributed attack infrastructure.

AI-driven exploitation of Actions misconfigurations, underscoring that CI/CD pipelines themselves are now high-value targets rather than mere developer tooling.

The downstream impact falls primarily on internet-facing web hosting environments. Successful exploitation of CVE-2026-41940 against cPanel and WHM can expose multiple customer accounts, hosted websites, backing databases, mailboxes, and application configuration.

For repository owners, the abuse translates into involuntary participation in scanning and exploit operations, potential account sanctions for resource misuse, and reputational damage associated with hosting active attack workflows.

This incident aligns with a broader pattern of GitHub Actions abuse seen in recent supply chain and CI/CD attacks, including compromises of popular third-party actions such as tj-actions/changed-files and campaigns like the “HackerBot-Claw”.

With the dinushchathurya GitHub account suspended, one attack path has been disrupted, but evidence of matching workflows, surviving forks and mirrors, and active C2 infrastructure indicates that this GitHub Actions botnet campaign should be treated as ongoing and globally distributed.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist