Gheist uses stolen GitHub tokens to leak private repository secrets
Original title: Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
Wiz Research says a tool it calls Gheist takes a stolen GitHub token, opens every reachable repository, and commits a workflow on a branch named ci-sync- plus random characters. The workflow base32-encodes secrets so log masking misses them, then the tool downloads the log through the GitHub API and deletes the run. GitHub holds suspicious workflows on public repositories, but Wiz says private repositories and GitHub Enterprise Server still run them. Wiz advises rotating exposed secrets and revoking the tokens that pushed the commits.
Unconfirmed: Wiz does not say how later AWS credentials were obtained, and some of the same accounts were used by other crews.
- More than 13,500 branches were recovered from over 850 compromised accounts.
- A variant added on October 19 searches self-hosted runners and uses Docker to reach host files.
- Since July 28, GitHub holds potentially malicious workflow runs only on public repositories.
- On October 6, 391 accounts renamed about 1,461 repositories to cracked-software lures.
- OIDC users should search cloud logs for role assumptions whose subject includes ci-sync-.
Impact: Private repository secrets, including production credentials, printed to logs
| Product | Affected |
|---|---|
| GitHub | private repositories and GitHub Enterprise Server |
- 1.Search GitHub audit logs for the gheist user agent and ci-sync- branches.
- 2.Rotate repository, organization, and environment secrets available to affected repositories.
- 3.Revoke the tokens that pushed the malicious workflow commits.
- Vendors
- GitHub
- Malware
- Gheist
- Organizations
- Wiz Research
From the original article
2 min read at helpnetsecurity.com
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository’s secrets into a log, and the attacker downloads it.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.