Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Summary: An automated campaign Wiz calls Gheist uses stolen GitHub tokens to plant workflows that print a repository's secrets into GitHub Actions logs in base32 encoding, which defeats GitHub's log masking, then downloads the logs and deletes the runs seconds later. Wiz has tracked the campaign since September 15 and recovered more than 13,500 planted branches from more than 850 compromised accounts, spanning personal projects and enterprise private repositories, with the activity still running as of October 24.
What's compelling: GitHub's safeguard that holds suspicious workflow runs applies only to public repositories on github.com, so in private repositories and GitHub Enterprise Server the payload ran, and deleting the branch or the run does not undo the exposure - every secret the repository could read has to be rotated.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026