Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
74
Malware
Gheist
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 26, 2026
- Last mentioned3d ago
Timeline
3 articles · newest firstGheist uses stolen GitHub tokens to harvest cloud secrets
Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.
76
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Appears with
- GitHubvendor · 3
- Wiz Researchorganization · 2
- GitHub Enterprise Serverproduct · 2
- GitHub Actionsproduct · 2
- Megalodonmalware · 1
- PolinRidermalware · 1
- Wizorganization · 1
- GhostActionmalware · 1
- GitGuardianorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.