Gheist uses stolen GitHub tokens to harvest cloud secrets
Original title: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.
An ongoing campaign dubbed Gheist abuses compromised GitHub tokens to harvest cloud secrets and credentials from developer repositories, according to Wiz Research. A workflow named sync-check prints repository secrets into its run log, downloads that log through the GitHub API, and deletes the run seconds later. Wiz began tracking the activity on September 15 and said it was still evolving as of October 24. Safeguards GitHub added in July cover public repositories, but not once an enterprise credential is compromised.
Unconfirmed: Wiz says overlap suggests stolen tokens may be reused or shared; that is not confirmed.
- API requests carry the user agent gheist, which names the campaign.
- Wiz reported the activity to GitHub.
- Affected accounts also overlap other GitHub abuse, including Actions compute use.
- The campaign reaches personal projects and private enterprise repositories.
Impact: Cloud secrets and credentials taken from repositories
| Product | Affected |
|---|---|
| GitHub | — |
- 1.Search repositories for a workflow named sync-check reachable by GitHub tokens.
- Vendors
- GitHub
- Malware
- Gheist
- Organizations
- Wiz Research
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 142a2e80d6a5fef7c9df2e421245edcb | ing-fortune-500-brands#recipe=similar-items&sourcecontentid=142a2e80d6a5fef7c9df2e421245edcb) Operation DoppelBrand: Weaponizing Fortune 500 Brands by |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
8 min read at darkreading.com
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.