'Gheist' Weaponizes Stolen GitHub Tokens to Steal Cloud Secrets

Overview

Gheist is an ongoing, automated campaign reported by Wiz Research that uses stolen GitHub tokens to extract secrets from developer repositories. Wiz counts more than 13,500 malicious branches across more than 850 compromised GitHub accounts, affecting roughly a dozen companies. Tracking began on September 15, and the campaign was still active as of October 24.

The name comes from the gheist user agent string the tooling sends on GitHub API requests.

How It Works

1. Attackers use a stolen token to push a workflow named sync-check on a branch named ci-sync- plus six characters.
2. The workflow prints the repository's secrets into the workflow log, Base32-encoded. GitHub only masks values that appear verbatim, so the encoding defeats masking.
3. The attackers download the log through the GitHub API and delete the run within seconds.

Because the secrets leave through GitHub's own API, there is no outbound connection to a command server to block.

Token sources that Wiz could trace include infostealer logs and tokens exposed in earlier supply-chain attacks, such as the March compromise of the Trivy scanner. A GitHub safeguard that pauses suspicious workflow runs stopped every public-repository run Wiz checked, but it does not cover private repositories or GitHub Enterprise Server.

In one enterprise case, the tooling cycled through several users' and automation accounts' tokens within minutes and cloned private repositories before planting the workflow. Hours later, the same organization's cloud credentials were used to enumerate AWS Secrets Manager.

A second job targets self-hosted runners, searching for credentials such as AWS instance role credentials and Kubernetes service account tokens. Wiz calls it buggy and reports no successful run. Wiz says Gheist is distinct from GhostAction, which uses different workflow files.

What To Do

• Hunt in GitHub audit logs for ci-sync-* branches and the gheist user agent.
• Rotate every secret (repository, organization and environment) reachable from an affected repository. Deleting the run or branch does not undo the exposure.
• Revoke the tokens that pushed the commits and check their owners' devices for infostealers.
• Treat any self-hosted runner that ran a ci-sync branch, and its cloud instance role, as compromised.
• Prefer short-lived, fine-grained tokens and restrict who can create workflows.

Sources

• Dark Reading — 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
• The Hacker News — Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs