Gheist mines secrets from 850+ private GitHub repos with stolen tokens

Wiz Research has been tracking an automated campaign it calls Gheist since 15 September, named after the user agent its tool sends with GitHub API requests. The tool takes a stolen access token, finds every repository that token can reach, and in each one creates a branch named ci-sync- plus six random characters, committing a workflow file at .github/workflows/sync-check.yml.

That workflow runs on push, prints the repository’s configured secrets into the job log encoded in base32 to dodge GitHub’s log masking, then the tool pulls the log through the GitHub API and deletes the run within seconds. Wiz has recovered more than 13,500 of these planted branches across over 850 compromised accounts, from personal projects to private enterprise repositories, and in at least one case the stolen cloud credentials were then used to enumerate AWS Secrets Manager. A newer variant also searches self-hosted runners for credentials on the host itself.

GitHub’s approval hold on suspicious workflow runs, live since 28 July, has blocked every public-repository attempt Wiz observed. It does not apply to private repositories or GitHub Enterprise Server, which is where the campaign is still running as of 24 October.

Why it matters: write access to a repository is enough to read every secret configured in it, and this campaign is proof that attackers are automating exactly that at scale. Wiz recommends checking Actions history for branches matching ci-sync-* and runs that completed and were deleted in under a minute, rotating any secrets a compromised token could reach, and pinning OIDC trust policies to protected branches rather than any branch.