Gheist campaign steals secrets from hundreds of GitHub accounts

Security researchers have identified the Gheist campaign as a broad abuse of stolen GitHub tokens to harvest repository secrets. Since 15 September 2026, the operation has planted more than 13,500 rogue branches across over 850 accounts, with attackers able to extract credentials from private enterprise repositories even after GitHub blocked execution in public projects.

The attack chain begins by creating a branch named ci-sync- followed by six random characters, then committing a malicious workflow at .github/workflows/sync-check.yml with the message “ci: sync config”. This push triggers a workflow that dumps environment variables and repository secrets. GitHub masks secret values in logs only when they appear verbatim; a base32-encoded secret can be printed in full.

After the job runs, the attacker’s tool retrieves the workflow log via the GitHub API using the user agent “gheist” and deletes the run, meaning the secrets leave through GitHub’s own API rather than an attacker domain or outbound connection that can be blocked.

A second variant, observed from 19 October 2026, introduces a job named sync-host to target self-hosted runners. This variant scans the host filesystem, process environments, and mounted Docker containers for 31 credential formats, including cloud metadata, Kubernetes tokens, and API keys for AI providers such as Anthropic, Hugging Face, Groq, and NVIDIA.

Researchers note no single group is confirmed as behind Gheist; stolen tokens come from infostealer logs and breaches like the March 2026 Trivy supply-chain incident, with overlaps across cracked software lures, cryptomining runners, the May 2026 Megalodon attack, and DPRK-linked PolinRider malware. Since 28 July 2026, GitHub has paused suspicious workflow runs in public repositories, though private repositories and GitHub Enterprise Server remain vulnerable.

Defenders are advised to hunt for branches matching ci-sync-* and to audit logs showing deleted runs from the gheist user agent; check AWS CloudTrail for OIDC role assumptions referencing ci-sync- branches; revoke compromised tokens, rotate exposed secrets, and rebuild affected self-hosted runners containing .gdmp_pat or .gdmp_sweep files.