Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

A threat actor leveraged widespread GitHub Actions workflow compromises to exploit a cPanel and WHM authentication bypass vulnerability, using GitHub-hosted runners as distributed infrastructure to scan, attack, and harvest sensitive credentials from thousands of internet-facing servers.