Poisoned Pipeline / Incidents / AS145
GitHub Actions abuse for cPanel/WHM exploitation
Socket: large-scale GitHub Actions abuse powering a distributed
cPanel and WHM exploitation campaign (CI as compute, not just secret theft).
Mapped techniques
- T0166 Trigger pipeline execution
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
supply-chain campaign
Abused Actions runners as workers.
Public workflows used as a botnet.