Gheist Abuses GitHub Tokens to Steal Secrets from 13,500 Branches
First merged summary.
Gheist campaign deploys malicious GitHub Actions workflows on over 13,500 branches across 850 accounts to steal secrets, with private repos and Enterprise Server unaffected by public-repo mitigations.
Wiz Research tracked the Gheist campaign from September 15, where actors use compromised tokens to commit workflows named sync-check that encode secrets in base32 to bypass masking, print them into logs, download logs via API, and delete runs. The activity hit more than 13,500 branches on over 850 accounts, with about two-thirds removed by October 24. GitHub's July 28 safeguards blocked public repository runs but not private ones or GitHub Enterprise Server. Variants include October 19 self-hosted runner searches and AWS Secrets Manager enumeration.
- Tracked since September 15
- 13,500+ branches on 850+ accounts
- Workflows use base32 encoding and API download-delete
- Affects private repos and GitHub Enterprise Server
- October 19 variant searches self-hosted runners
- October 6: 391 accounts renamed 1,461 repos
Timeline
dated events in the reporting · oldest first- Jul 28, 2026GitHub holds suspicious public workflows · Infosecurity Magazine
- Sep 15, 2026Wiz begins tracking Gheist campaign · Dark Reading
- Oct 6, 2026391 accounts rename 1,461 repositories to cracked-software · Help Net Security
- Oct 19, 2026Variant searches self-hosted runners using Docker · Help Net Security
- Oct 24, 2026Two-thirds of accounts removed · Infosecurity Magazine
What each outlet adds
beyond the shared facts- Infosecurity MagazineTrivy compromise link and October 24 account removal status
- Help Net SecurityOctober 6 rename lures and OIDC search guidance
- Dark ReadingGheist campaign name and AWS Secrets Manager enumeration
- CSO OnlineDetails on sync-host job and production secret exposure
- Threat actors
- GheistGhostAction
- Malware
- Gheist
Coverage
oldest first · one row per article · UTC- · 6d ago
Infosecurity MagazineFirst report
Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
- · 6d ago
Dark Reading
Gheist uses stolen GitHub tokens to harvest cloud secrets
Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.
- · 6d ago
Help Net Security
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
- · 4d ago
CSO Online
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
- · 4d ago
GhostAction GitHub campaign slows after hitting tens of thousands of repos
GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.
- · 3d ago
The Register · Security
GitHub issues used in CI attacks on 61 public repositories
Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.
- · 7h ago
Cyber Security News
Hackers target 61 GitHub repos with command injection
Coordinated attack on 61 repositories used command injection in GitHub Actions to steal CI/CD secrets; 83 malicious issues and PRs identified.