Gheist Campaign Exploits Stolen GitHub Tokens to Access Secrets

• •Gheist campaign exploits stolen GitHub tokens to access sensitive repository secrets.
• •Over 13,500 branches have been created across more than 850 compromised accounts.
• •GitHub's new controls prevent malicious workflows in public repositories but not in private ones.

An ongoing automated campaign, dubbed Gheist, is exploiting stolen GitHub tokens to create malicious workflows that expose repository secrets in GitHub Actions logs. The campaign has affected over 850 accounts and resulted in the creation of more than 13,500 branches across various repositories, including private enterprise ones. Attackers utilize these tokens to plant workflows that print sensitive information into logs, which they then download before deleting the runs. GitHub has implemented controls that prevent malicious workflows in public repositories from executing without approval, but these protections do not extend to private repositories or GitHub Enterprise Server. Wiz, the cloud security company tracking the campaign, identified that the attackers have been cycling through user tokens and cloning repositories since September 15. As of October 24, two-thirds of the compromised accounts were no longer available on GitHub, likely due to responses from the platform. The campaign continues to evolve, posing a significant risk to organizations using GitHub.