Back Darkreading

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

Darkreading • October 26, 2026

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories , bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.

Dubbed "Gheist," the campaign has left more than 13,500 malicious branches — or versions of a project's code — across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.

The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards GitHub introduced in July, according to the report .

"The control GitHub added is focused on protecting public repositories from workflow abuse vectors," Wiz researcher Rami McCarthy tells Dark Reading. However, "once an enterprise credential is compromised, that control doesn’t apply," he adds.

Related: 10 Software Security Practices Built for the 250 Years

Wiz also found overlap between Gheist-affected GitHub accounts and other abuse campaigns, including repository-based malware distribution, attempts to exploit GitHub Actions for computing resources, and possible infections linked to other malware operations.

This overlap — which distinguishes Gheist from similar campaigns — suggests stolen developer tokens may be reused or shared among threat actors, "demonstrating the complexity and activity of this threat landscape," McCarthy says.

Workflow Runs the Cyber-Theft Show

The campaign relies on a workflow named "sync-check," which is committed to each repository accessible through a stolen token, the researchers wrote.

"The workflow seeks to print the repository’s secrets into its own workflow log," they wrote. "Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent 'gheist,' which gives the campaign its name."

Wiz began tracking the activity Sept. 15 and said the operation remains active and evolving as of Oct. 24. The researchers reported the activity to GitHub, and two-thirds of the implicated accounts are no longer available, which "likely indicates response activity," according to the report.

Stolen Tokens Fuel Further Secrets Heist

The tokens appear to have come primarily from two sources: infostealer malware and credentials exposed in earlier software supply chain compromises, the researchers noted.

GitHub tokens authorize users and applications to access repositories, code, and administrative functions, making them valuable to attackers seeking to compromise projects and organizations.

Related: State Bank of India Suffers a Customer PII Data Leak

Gheist uses stolen GitHub tokens to create branches named "ci-sync-" followed by six characters. The attackers then add the GitHub Actions workflow at .github/workflows/sync-check.yml, using the commit message "ci: sync config," according to the report.

"The commit is unsigned and authored as the token's owner," the researchers wrote. The resulting push event triggers a workflow that attempts to print environment variables and repository secrets into its log. The attack encodes the output using Base32 before retrieving the logs through the GitHub API and deleting the workflow run seconds later.

"Because the secrets leave through GitHub's own API, there is no attacker domain or outbound connection to block," the researchers explained.

Enterprises in the Crosshairs

A key finding is that Wiz observed successful attacks in private repositories and enterprise environments, where the public-repository safeguard did not apply. Most GitHub-targeted activity, by contrast, primarily affects public repositories, McCarthy tells Dark Reading.

"The attack succeeded in the environments organizations considered safest because a credential issued to a human months ago still carried full write authority," says James Matchett, head of security at supply chain security firm Cloudsmith, in an email interview. "'Private' is not a control. Scoped, short-lived credentials, a tight inventory of what can push and pull, and the discipline to rotate after every incident are the control.”

Related: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

Wiz observed the attackers cycling through tokens belonging to multiple users and automation accounts, and cloning private repositories before planting malicious workflows. Within hours, cloud credentials from the same organization were used to enumerate AWS Secrets Manager, the researchers added.

Wiz estimates that the campaign affected "on the scale of a dozen companies," McCarthy says. However, "we have not seen consistent or automated abuse outside of mass cloning of GitHub repositories and the core credential theft," he says.

Defending Against Token Abuse

Token abuse is an increasingly common way for attackers to infiltrate organizations through the developer pipeline. Research presented at Black Hat Europe last year found that some of the most significant software supply chain incidents over the preceding year involved threat actors exploiting GitHub flaws. Defenders therefore must treat developer projects as critical organizational assets.

To defend against Gheist and other forms of token abuse , Wiz urged security teams to hunt for malicious GitHub Actions workflows, rotate exposed secrets, and treat compromised self-hosted runners as potential infrastructure breaches.

More specifically, defenders should look for branches named "ci-sync-" followed by six characters, where the only change is a new .github/workflows/sync-check.yml file with the commit message "ci: sync config," the researchers advised. Administrators also should review GitHub audit logs for workflow runs on "ci-sync-*" branches that were deleted within a minute of completion, as well as activity from the user agent "gheist."

For broader protection against GitHub token abuse , Waseem Ahmed, head of engineering at security firm Secure.com, recommends that organizations "replace long-lived personal access tokens with GitHub Apps or short-lived fine-grained tokens" and "require reviewers on any environment that holds production secrets." These measures can help limit attackers' ability to access sensitive credentials even if they obtain valid tokens.

Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

How to Harness your Security Operations Data for Enterprise Defense

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gheist Campaign Exploits Stolen GitHub Tokens to Access Secrets An ongoing automated campaign, dubbed Gheist, is exploiting stolen GitHub tokens to create malicious workflows that expose repository secrets in GitHub Actions logs. The campaign has affected over 850 accounts and resulted in the creation of more than 13,500 branches across various repositories, including private enterprise ones. Attackers utilize these tokens to plant workflows that print sensitive information into logs, which they then download before deleting the runs. GitHub has implemented controls that prevent malicious workflows in public repositories from executing without approval, but these protections do not extend to private repositories or GitHub Enterprise Server. Wiz, the cloud security company tracking the campaign, identified that the attackers have been cycling through user tokens and cloning repositories since September 15. As of October 24, two-thirds of the compromised accounts were no longer available on GitHub, likely due to responses from the platform. The campaign continues to evolve, posing a significant risk to organizations using GitHub. 3 sources 70

Extracted Entities

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (1)

Platforms (1)

Tools (2)