Gheist harvests secrets through malicious GitHub Actions workflows
Original title: Gheist turns GitHub Actions into a secret extraction service
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
Wiz Research says a threat actor it calls Gheist plants GitHub Actions workflows on compromised accounts, prints secrets into logs, pulls those logs through GitHub’s API, and deletes the runs within seconds. GitHub’s new approval hold blocked the public-repository runs, but Wiz saw successful execution on private repositories and GitHub Enterprise Server. A later variant also searches self-hosted runners for tokens, keys, and cloud credentials. Wiz says credentials from one organization were later used to enumerate AWS Secrets Manager.
Unconfirmed: Wiz says bugs in the evolved runner variant mean successful extraction of every targeted credential should not be assumed.
- Workflows named sync-check encode secrets in base32 so GitHub’s log masking does not hide them.
- Environment jobs can expose production secrets as well as repository-level secrets.
- A sync-host job looks for tokens, keys, Docker sockets, metadata, and Kubernetes service accounts.
- Teams were told to hunt branches matching ci-sync- plus six characters and commits titled ci: sync config.
- Wiz links likely sources to infostealer logs and the March Trivy compromise.
Impact: Repository, environment, runner, and cloud credentials exposed
| Product | Affected |
|---|---|
| GitHub Actions | private repositories and GitHub Enterprise Server |
- 1.Search for ci-sync- branches, commits titled ci: sync config, and runs deleted seconds after completion.
- 2.Investigate cloud role assumptions tied to those attacker-created branches.
- 3.Revoke compromised tokens and rotate repository, organization, and environment secrets.
From the original article
2 min read at csoonline.com
A threat actor dubbed Gheist is turning compromised GitHub accounts into credential-harvesting platforms. By planting malicious GitHub Actions workflows in private repositories, the attackers can expose repository and environment secrets, then retrieve them through GitHub APIs before deleting evidence of the activity.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.