Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Original title: Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
Wiz said it tracked Gheist from September 15 and found secret-stealing GitHub Actions workflows on more than 13,500 branches across more than 850 accounts. Stolen tokens, linked to infostealer logs and earlier compromises including Trivy, were used to print repository secrets into workflow logs, download them via the API, and delete the runs. GitHub's July 28 hold left examined public runs in action_required, but private repositories and GitHub Enterprise Server were not covered. As of October 24 about two-thirds of implicated accounts were gone; Wiz says the campaign continues.
Unconfirmed: Wiz says the drop in available accounts likely reflects response activity, and that Gheist is still ongoing.
- Attackers reached personal projects and private enterprise repositories the tokens could access.
- One variant exposed deployment-environment secrets and later searched self-hosted runners.
- Hours after private clones, the same organizations' cloud credentials enumerated AWS Secrets Manager.
- Wiz called the runner-search job buggy and reported the campaign to GitHub.
Impact: Repository secrets and later cloud credentials exposed
- 1.Check private repositories and GitHub Enterprise Server for attacker-created workflow branches
- 2.Rotate repository and cloud credentials tied to implicated tokens
- ATT&CK
- T1078 Valid AccountsT1528 Steal Application Access TokenT1552 Unsecured CredentialsT1580 Cloud Infrastructure Discovery
- Vendors
- GitHub
- Threat actors
- Gheist
- Organizations
- WizAmazon Web Services
From the original article
2 min read at infosecurity-magazine.com
A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.