Yup, happened to me this morning. He managed to hack into my WHM, so all my sites under that main account were hacked!
Lovely stuff…
Luckily ‘all’ he did was added an index.html file in the main root of the domain, and uploaded his trademark index.php file so all my sites were showing his “ByLenis was here” page…
I deleted the index.html file; uploaded a fresh copy of the index.php to the main root folder; then changed all my WHM, cPanel & FTP passwords.
As far as I can tell, that’s all he did in my case… But I would recommend the links above to make sure there’s nothing else he’s been messing with.