Phishing subdomains constantly created

Hi there,
We are noticing it from a long time but can't find where it's from. Sometimes once a week, sometimes 3 or 4 the same day, we are receiving "abuse" emails from companies for hosting phishing websites (our IP has been blocked several times).

At the beginning it touched only few customers using Wordpress and mysterious plugins, we didn't care a lot and suspended the accounts until reactions. Now it seems to touch anyone. We (in the team) have created few accounts for our own usage, some are active, some were never used (nothing uploaded since the creation). Despite this, every week we see phishing subdomains created (containing phishing website) or sometimes only 1 .html is created with a JS redirection to another account.

We've noticed that sometimes it's the exact same IP in the .lastlogin, so when we grep it in cpanel logs, here is what we see:

At first sight, I understand that he is using the login form. It's like he has the passwords (hard to believe because we create users from WHMCS with generated passwords =/ )
Then:

As you can see, in the first "block", he tries some accounts and fails but gains access to acct4... After that, in the second block, we see him creating the subdomains using the web panel (or a script using it), and in the third part he's using the file manager to create and modify some files on acct5...

Users capable of setting the same password everywhere, why not. But having this attack on multiple accounts including the team's websites, it's hard to believe. Moreover, the account password can be used to access the FTP directly...

I must say that we've run LMD and chkrootkit (and some other check scripts), but everything is negative. Has anyone encountered such an issue, or have an idea please?

Thank you for your help.

 

This is indeed a vector. But we we've changed our WHMCS passwords and the database password at the same time. Concerning SSH, we receive an email anytime someone not whitelisted is connected, and we currently only have our IP listed. We often see SQL injections attempts (with AES_ENCRYPT strings) but as we're updated, it always fails. Strangely, these attempts are from USA while the successfully hacks are done from Tunisia. And of course, the ISP never answered our abuses.

Yes we do, in order to keep a consistency in WHMCS. We also pay our personal hosting websites, so it's a must to use WHMCS.

Any other idea ?
Thank you for your help.