Stolen GitHub Tokens Expose Cloud Secrets in Gheist Attack

Gheist is a supply-chain style attack that weaponises stolen GitHub tokens to exfiltrate cloud secrets from thousands of developer repositories. Wiz Research says the operation began tracking activity on 15 September and remained active as of 24 October, with more than 13,500 malicious branches across over 850 compromised GitHub accounts.

While public repositories were largely safeguarded by safeguards GitHub introduced in July, Wiz notes the attack also hit private enterprise repositories where those protections do not apply. The campaign relies on a workflow named "sync-check" committed to each repository accessible by a stolen token; the workflow prints environment variables and repository secrets into its log, then the attacker retrieves the log via the GitHub API and deletes the run seconds later. The run’s user agent is reported as "gheist", which lends the campaign its name.

Tokens appear to originate mainly from infostealer malware and earlier supply-chain compromises, enabling attackers to create branches named "ci-sync-" plus six characters and deploy a .github/workflows/sync-check.yml with the commit message "ci: sync config". The process results in a pushed event that exposes secrets through GitHub’s API rather than any attacker domain.

Wiz estimates the impact across private and enterprise environments—where public safeguards do not apply—and notes rapid credential reuse across multiple user and automation tokens, enabling subsequent enumeration of AWS Secrets Manager data.

In response, Wiz recommends hunting for malicious workflows, rotating exposed secrets, and treating compromised self-hosted runners as potential infrastructure breaches; security experts emphasise moving to short-lived or fine-grained tokens and enforcing strict environment access controls.