Gheist steals private GitHub secrets through workflow logs

Security researchers at Wiz have traced an automated campaign, dubbed Gheist, that uses stolen GitHub tokens to plant private-workflow configurations which print repository secrets into GitHub Actions logs. The attackers then download the exposed logs before deleting the runs.

The activity has affected both private repositories and GitHub Enterprise Server environments, with Wiz noting that a safeguard introduced by GitHub in July 2026 stops suspicious public-repository workflows but does not cover private repos or Enterprise Server. In GitHub audit logs, Gheist runs appear on newly created branches named ci-sync- followed by six random characters; deleting the branch or run does not undo the exposure.

Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts, ranging from personal projects to enterprise repositories. The campaign has involved reading secrets via workflows that access deployment-environment secrets, and in some cases enabled the attackers to enumerate AWS Secrets Manager using cloud credentials associated with the target organisation.

The researchers describe a self-contained workflow that creates a ci-sync- branch, commits a .github/workflows/sync-check.yml file with the message ci: sync config, and then prints environment secrets encoded in base32. The tool downloads the resulting log and deletes the run seconds later; the exposed secrets traverse through GitHub itself, leaving no attacker server to block.

Wiz’s indicators of compromise include the user agent gheist, branch patterns ci-sync-[six chars], and specific payload strings and files such as .gdmp_pat, .gdmp_patg and .gdmp_sweep. The campaign was ongoing as of 24 October 2026 and appeared to be evolving, with many affected accounts no longer present on GitHub.