Science & Tech · Cybersecurity · 58 mins ago
Gheist campaign exploits stolen GitHub tokens to expose repository secrets
Attackers used stolen GitHub tokens to plant secret-stealing workflows in repositories they could access, Wiz said.
The campaign, called Gheist, affected more than 850 compromised accounts and spread across more than 13,500 branches on GitHub.
The workflows printed repository secrets into GitHub Actions logs, which the attackers downloaded before deleting the runs.
GitHub’s approval hold stopped every public run Wiz checked, but the safeguard does not cover private repositories or GitHub Enterprise Server.
In those environments, some workflows ran and exposed secrets, including environment-scoped credentials that can be used for production systems.
Wiz traced some stolen tokens to infostealer logs and earlier supply-chain compromises, but did not say how many organizations had secrets exposed.
The campaign was still active and changing as of October 24, although about two-thirds of the implicated accounts were no longer available on GitHub.
Organizations should revoke affected tokens and rotate every secret the exposed repositories could access.
The Gheist campaign used stolen GitHub access tokens to plant workflows that exposed repository secrets in GitHub Actions logs.
Wiz found more than 13,500 planted branches across more than 850 compromised accounts.
The workflows succeeded in private repositories and GitHub Enterprise Server environments, but a GitHub safeguard stopped every public-repository run Wiz checked.
The campaign targeted repositories accessible to the stolen tokens, including personal projects and private enterprise repositories.
Wiz said the campaign was still running and changing as of October 24, 2026.
- Who
- Attackers using stolen GitHub tokens, tracked by cloud security company Wiz. Their identities are not stated.
- What
- The attackers planted GitHub Actions workflows to print repository secrets into logs, then downloaded the logs and deleted the runs.
- When
- Wiz had tracked the campaign since September 15, 2026. It was still running as of October 24.
- Where
- GitHub repositories, including private repositories and GitHub Enterprise Server environments.
- Why
- To steal repository secrets and credentials. The attackers’ broader motive is not stated.
This story does not have two clearly opposing sides.
GitHub introduced a control that holds potentially malicious workflow runs in public repositories until a collaborator approves them.
Wiz began tracking the Gheist campaign.
Wiz said the campaign was still ongoing and changing, and about two-thirds of implicated accounts were no longer available on GitHub.
Wiz published research on the campaign.
- Planted branches
- More than 13,500
- Compromised accounts
- More than 850
- Campaign tracking began
- September 15, 2026
- Public-run safeguard introduced
- July 28, 2026
- Accounts unavailable by October 24
- About two-thirds of those implicated
3 sources
What people are saying
currently applies to public repositories on github.com only
buggy