Ethical Hacking News
Gheist, a malicious campaign, has been using stolen GitHub tokens to steal private repository secrets via Actions Logs. This recent cyber attack has raised concerns among the cybersecurity community, as it highlights the vulnerability of private repositories and GitHub Enterprise environments to such threats. Read the full story to learn more about the Gheist campaign and how to protect your repositories from similar attacks.
Gheist, a malicious campaign, uses stolen GitHub tokens to steal private repository secrets via Actions Logs. The campaign plants workflows that print repository secrets into GitHub Actions logs, which attackers can download and delete. Over 13,500 compromised accounts have been recovered, with the campaign still active and changing. Protecting private repositories and GitHub Enterprise environments from Gheist is essential. Check for compromised repositories by looking for suspicious file changes and user activity. Take proactive measures to prevent attacks, such as rotating secrets and revoking tokens.
Gheist, a malicious campaign, has been using stolen GitHub tokens to steal private repository secrets via Actions Logs. This recent cyber attack has raised concerns among the cybersecurity community, as it highlights the vulnerability of private repositories and GitHub Enterprise environments to such threats.
According to an analysis by cloud security company Wiz, the Gheist campaign has been using stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs, which the attackers then download before deleting the runs. This means that even if the attackers are deleted, the repository secrets remain exposed.
The attacks have succeeded in private repositories and GitHub Enterprise environments, and Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts. It is worth noting that the campaign is still active, and as of October 24, the campaign was still running and changing.
The Gheist campaign is distinct from another campaign, GhostAction, which uses different workflow files. However, both campaigns highlight the importance of protecting private repositories and GitHub Enterprise environments from such threats.
To check if a repository has been compromised, Wiz recommends looking for branches named "ci-sync-" followed by six characters, where the only change is a new "github/workflows/sync-check.yml" file with the commit message "ci: sync config". In GitHub audit logs, look for workflow runs on "ci-sync-*" branches that were deleted within a minute of finishing, and for any activity from the user agent "gheist".
Wiz also advises to rotate every repository, organization, and environment secret the repository could use, revoke the tokens that pushed the commits, and check their owners' devices for infostealers. If a "ci-sync" branch ran on a self-hosted runner, treat the machine and its cloud instance role as compromised.
The Gheist campaign highlights the importance of protecting private repositories and GitHub Enterprise environments from such threats. It is essential to take proactive measures to prevent such attacks and protect sensitive information.
Related Information:
https://www.ethicalhackingnews.com/articles/Gheist-A-Threat-to-Private-Repository-Security-ehn.shtml
https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
Published: Mon Oct 26 13:07:22 2026 by llama3.2 3B Q4_K_M
