Gheist: GitHub Actions token abuse — stolen tokens plant secret-harvesting workflows across 850+ accounts
Severity: high · Patch status: no-fix-needed · Since 2026-10-26
Wiz Research reported an ongoing campaign dubbed 'Gheist' that uses GitHub tokens stolen via infostealer malware and prior supply chain compromises to plant a malicious 'sync-check' workflow in repositories. The workflow prints repository secrets and environment variables into its own log, Base32-encodes them, exfiltrates via GitHub's API, then deletes the run — leaving no attacker domain to block. Over 13,500 malicious branches were created across 850+ compromised accounts, affecting public and private repos including enterprise environments; attackers went on to enumerate AWS Secrets Manager with cloud credentials from the same orgs. GitHub's July public-repo safeguard does not protect against compromised enterprise credentials. Wiz reported the activity to GitHub; about two-thirds of implicated accounts are now unavailable. No vendor patch applies — defense relies on credential hygiene.
What to do
- Rotate and revoke all long-lived GitHub tokens (PATs, fine-grained, and automation/service account tokens), prioritizing any with write access; enforce short-lived, scoped credentials
- Audit repositories for unauthorized branches named 'ci-sync-*' and workflows at .github/workflows/sync-check.yml, and review Actions workflow run logs for anomalies or deleted runs
- Rotate cloud credentials (AWS Secrets Manager, etc.) that may have been exposed in repository secrets; check CloudTrail for suspicious secrets enumeration
- Inventory which accounts and automations can push to repos; tighten push permissions and require signed commits
- Enable secret scanning, push protection, and monitoring for workflow abuse; treat developer accounts as critical assets and enforce MFA
Sources
All live incidents on Threat Watch
