Gheist uses stolen GitHub tokens to leak private repository secrets
Original title: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
Wiz says the Gheist campaign, tracked since September 15, uses stolen GitHub tokens to push workflows that print repository secrets, base32-encoded, into GitHub Actions logs, then downloads and deletes the runs. The activity succeeded in private repositories and GitHub Enterprise environments, where GitHub's hold on suspicious workflow runs does not apply. Wiz recovered more than 13,500 ci-sync branches from more than 850 accounts, and said the campaign was still changing as of October 24. Exposed secrets should be rotated and the pushing token revoked; deleting the branch does not undo the leak.
Unconfirmed: Wiz does not say how many organizations had secrets exposed or who later used the AWS credentials it observed.
- Each branch is named ci-sync- plus six characters and adds .github/workflows/sync-check.yml.
- The commit message is "ci: sync config," and the commit is unsigned.
- About two-thirds of the involved accounts were no longer available on GitHub.
- A self-hosted-runner job searches for credentials, but Wiz reports no successful run.
- Token sources traced by Wiz include infostealer logs and the March Trivy compromise.
Impact: Private repository and environment secrets exposed in logs
| Product | Affected |
|---|---|
| GitHub Actions | — |
| GitHub Enterprise Server | — |
- 1.Rotate every secret the affected repository could read.
- 2.Revoke the token that pushed the ci-sync branch.
- 3.Search for ci-sync branches, gheist user-agent activity, and runs deleted within a minute.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1213.003 Code RepositoriesT1552 Unsecured Credentials
- Vendors
- GitHub
- Organizations
- WizGitGuardian
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 1dc5af9cce950aad1eb1546ecce8565b117540c4 | b976bdc084a9a021713133291 Git blob SHA (separator version): 1dc5af9cce950aad1eb1546ecce8565b117540c4 Git blob SHA (self-hosted job version): c665b778b2d82245329 |
| sha1 | c665b778b2d822453293003e7ca0bbb2cb08e39d | 46ecce8565b117540c4 Git blob SHA (self-hosted job version): c665b778b2d822453293003e7ca0bbb2cb08e39d Versions of the workflow that list a repository's deploymen |
| sha1 | d09535857a741bbb976bdc084a9a021713133291 | da02fd455d314be2a95007516a6 Git blob SHA (timeout version): d09535857a741bbb976bdc084a9a021713133291 Git blob SHA (separator version): 1dc5af9cce950aad1eb1546ec |
| sha1 | f3da2b8b357dcda02fd455d314be2a95007516a6 | gdmp_patg File : .gdmp_sweep Git blob SHA (plain workflow): f3da2b8b357dcda02fd455d314be2a95007516a6 Git blob SHA (timeout version): d09535857a741bbb976bdc084a9 |
From the original article
6 min read at thehackernews.com
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.