Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

Wiz Research has identified a campaign named Gheist that abuses stolen GitHub tokens to deploy malicious workflows across both public and private repositories. The attack creates a branch named ci-sync- followed by random characters and commits a workflow file designed to exfiltrate repository secrets by encoding them in base32 within workflow logs, bypassing GitHub's secret masking. The campaign has evolved with multiple variants, including one that targets self-hosted runners to collect system-level credentials. While GitHub's approval controls have prevented execution in public repositories, the attack has successfully run in private repositories and enterprise environments, leading to credential exfiltration and follow-on cloud access.

AI-extracted · verify before operational use