Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Gheist still steals secrets from private GitHub repositories

6 sources · 7 articlesFirst reported Updated ()1
What's new

October 27–28: Help Net Security details the October 6 lure renames and an October 19 Docker host search; CSO Online describes one organization’s later AWS Secrets Manager enumeration.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Gheist remains active on private and Enterprise GitHub repositories after public workflow runs were held.

Wiz Research says Gheist, tracked since September 15, 2026, uses stolen GitHub tokens to plant Actions workflows on reachable repositories. The sync-check workflow base32-encodes secrets into logs so masking misses them; the tool then downloads the log through the GitHub API and deletes the run. Researchers recovered more than 13,500 ci-sync branches from over 850 accounts. About two-thirds of those accounts were gone by October 24, while the campaign was still changing. GitHub has held suspicious public runs since July 28, but private repositories and GitHub Enterprise Server still execute them. Infosecurity Magazine describes later AWS Secrets Manager enumeration at multiple organizations, while CSO Online describes one; The Hacker News says the self-hosted runner search had no successful run.

Key facts
  • More than 13,500 ci-sync branches were recovered from over 850 accounts.
  • Branches add unsigned commits titled "ci: sync config" and sync-check.yml.
  • On October 6, 391 accounts renamed about 1,461 repositories into cracked-software lures.
  • An October 19 self-hosted job searches hosts; Wiz calls it buggy.
  • Wiz links tokens to infostealer logs and the March Trivy compromise.
  • Wiz advises rotating exposed secrets and revoking the pushing token.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 28, 2026GitHub begins holding suspicious workflow runs on public repositories. · Wiz Blog
  2. Sep 15, 2026Wiz starts tracking the Gheist token-abuse campaign. · Wiz Blog
  3. Oct 6, 2026391 accounts rename about 1,461 repositories into software lures. · Wiz Blog
  4. Oct 19, 2026A variant adds a self-hosted job that searches hosts for secrets. · Wiz Blog
  5. Oct 24, 2026Campaign still changing; about two-thirds of accounts gone. · Wiz Blog

What each outlet adds

beyond the shared facts
  • Wiz BlogDistinguishes two tools and notes PolinRider and Megalodon overlap.
  • The Hacker NewsReports no successful self-hosted runner search and names Trivy.
  • Infosecurity MagazineSays multiple organizations’ credentials later enumerated AWS Secrets Manager.
  • Dark ReadingIdentifies the API user agent gheist and GitHub notification.
  • CSO OnlineLimits AWS enumeration to one organization and details the sync-host job.
Vendors
GitHub
Products
GitHub ActionsGitHub Enterprise ServerAWS Secrets ManagerTrivy
Threat actors
GheistGhostAction
Malware
GheistGhostActionPolinRiderMegalodon
Organizations
WizWiz ResearchGitGuardianAmazon Web ServicesGitHub

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Wiz BlogFirst report

    Gheist abuses stolen GitHub tokens to dump repository secrets

    Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.

  2. · 4d ago The Hacker News

    Gheist uses stolen GitHub tokens to leak private repository secrets

    Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.

  3. · 4d ago Infosecurity Magazine

    Gheist used stolen GitHub tokens to steal secrets from 850 accounts

    Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.

  4. · 4d ago Dark Reading

    Gheist uses stolen GitHub tokens to harvest cloud secrets

    Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.

  5. · 3d ago Help Net Security

    Gheist uses stolen GitHub tokens to leak private repository secrets

    Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.

  6. · 2d ago CSO Online

    Gheist harvests secrets through malicious GitHub Actions workflows

    Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.

  7. · 2d ago Dark Reading

    GhostAction GitHub campaign slows after hitting tens of thousands of repos

    GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.