Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Malware
Megalodon
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 25, 2026
- Last mentioned4d ago
Timeline
2 articles · newest firstGheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
Appears with
- GitHubvendor · 2
- GitHub Enterprise Serverproduct · 2
- GitHub Actionsproduct · 2
- PolinRidermalware · 2
- Gheistthreat actor · 1
- Wiz Researchorganization · 1
- GitGuardianorganization · 1
- Wizorganization · 1
- GhostActionmalware · 1
- Gheistmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.