Gheist abuses stolen GitHub tokens to dump repository secrets
Original title: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
Since September 15, 2026, Wiz Research has tracked Gheist, which uses compromised GitHub tokens to commit a sync-check workflow on every reachable repository. The workflow base32-encodes secrets so GitHub log masking misses them, then the tool downloads the log through the GitHub API and deletes the run. A control in place since July 28 holds the payloads on public repositories, but private repositories and GitHub Enterprise Server still run them. As of October 24 the attack was ongoing, and about two-thirds of implicated accounts were gone from GitHub.
Unconfirmed: Wiz says unavailable accounts likely reflect response after it reported the activity to GitHub, which is not independently confirmed.
- Tool A uses a hexadecimal branch suffix; Tool B uses base36 and an environment matrix.
- On October 19 Tool B added a self-hosted job that searches hosts for tokens and keys.
- That self-hosted job is buggy and does not collect GCP or Azure tokens.
- On October 6, 391 accounts renamed about 1,461 repositories into cracked-software lures.
- Some of the same accounts overlap PolinRider and the May Megalodon campaign.
Impact: Prints repository, environment, and later cloud credentials
| Product | Affected |
|---|---|
| GitHub Actions | — |
| GitHub Enterprise Server | — |
- 1.Search for ci-sync branches and .github/workflows/sync-check.yml.
- 2.Check audit logs for the gheist user agent deleting workflow runs.
- 3.Review CloudTrail for workflows on ci-sync branches assuming AWS roles.
- Vendors
- GitHub
- Threat actors
- Gheist
- Malware
- PolinRiderMegalodon
- Organizations
- Wiz Research
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 1dc5af9cce950aad1eb1546ecce8565b117540c4 | plain), d09535857a741bbb976bdc084a9a021713133291 (timeout), 1dc5af9cce950aad1eb1546ecce8565b117540c4 (separator), c665b778b2d822453293003e7ca0bbb2cb08e39d (self |
| sha1 | c665b778b2d822453293003e7ca0bbb2cb08e39d | out), 1dc5af9cce950aad1eb1546ecce8565b117540c4 (separator), c665b778b2d822453293003e7ca0bbb2cb08e39d (self-hosted job). Environment-matrix variants differ per r |
| sha1 | d09535857a741bbb976bdc084a9a021713133291 | lob SHAs: f3da2b8b357dcda02fd455d314be2a95007516a6 (plain), d09535857a741bbb976bdc084a9a021713133291 (timeout), 1dc5af9cce950aad1eb1546ecce8565b117540c4 (separa |
| sha1 | f3da2b8b357dcda02fd455d314be2a95007516a6 | es .gdmp_pat , .gdmp_patg , .gdmp_sweep Workflow blob SHAs: f3da2b8b357dcda02fd455d314be2a95007516a6 (plain), d09535857a741bbb976bdc084a9a021713133291 (timeout) |
From the original article
6 min read at wiz.io
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
By Rami McCarthy · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.