Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
Wiz says Gheist campaign dumps GitHub secrets via stolen tokens
Wiz Research said a campaign it calls Gheist has, since Sept. 15, 2026, used stolen GitHub tokens to plant secret-dumping Actions workflows, with more than 13,500 planted branches found.
Wiz Research said Sunday that since Sept. 15, 2026, it has tracked a campaign it calls Gheist that mass-abuses stolen GitHub tokens to plant a workflow that dumps repository secrets into GitHub Actions logs1.
The campaign commits a workflow named sync-check to every repository each token can reach, Wiz said1. The workflow is written to print the repository's secrets into its own log; the tooling then downloads that log through the GitHub API and deletes the run seconds later, according to the firm1.
API requests carry the user agent gheist, which Wiz said is how the campaign got its name1. Because the secrets leave through GitHub's own API, Wiz said there is no attacker domain or outbound connection to block1.
Wiz said it recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to private repositories in enterprise organizations1. A recent GitHub control has been blocking exploitation in public repositories, the firm said, but it reported successful exploitation and follow-on activity in private repositories and GitHub Enterprise environments1.
GitHub has, since July 28, 2026, held potentially malicious workflow runs in public repositories until a collaborator approves them1. Wiz said every public Gheist run it checked, including a self-hosted job variant, sat at action_required, and that the malicious payloads never ran1.
That hold does not apply to private repositories or GitHub Enterprise Server, Wiz said1. There, GitHub audit logs showed runs on ci-sync-* branches completing and then being deleted by the gheist user agent, and CloudTrail showed organizations' own workflows running on those branches and assuming AWS roles, which Wiz said proved Actions executed without approval1.
As of Oct. 24, Wiz said the attack was ongoing and evolving, and that roughly two-thirds of implicated accounts were no longer available on GitHub, which it said likely reflected response after it reported the activity to GitHub1.
Wiz also described other activity on some of the same accounts: on Oct. 18, 25 Gheist accounts each created a Windows RDP Runner repository within nine minutes in an apparent attempt to abuse Actions for free compute1. Some victims appeared infected with PolinRider, malware that hides JavaScript in build config files; on Oct. 19 and 20, three victims re-pushed Gheist commits with a loader appended to vite.config.js, Wiz said1. Fifty-seven accounts from Gheist's first phase were also victims of the Megalodon campaign in May, according to Wiz1.
