Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets
Do Son 
TL;DR
Security researchers uncovered the Gheist campaign, a mass-exploitation operation abusing stolen GitHub tokens to extract repository secrets. Since September 15, 2026, the Gheist GitHub campaign has planted over 13,500 rogue branches across more than 850 accounts. While a recent platform safeguard blocked execution in public projects, attackers successfully harvested credentials from private enterprise repositories.
What Happened in the Attacks
According to a report on the Gheist GitHub token abuse campaign by Wiz Research, the attack uses compromised tokens to create a branch named ci-sync- followed by six random characters. Next, the tool commits a malicious workflow file at .github/workflows/sync-check.yml with the message “ci: sync config”. This push event immediately triggers the workflow to dump all environment variables and repository secrets.
“GitHub masks secret values in logs only when they appear verbatim. A base32-encoded secret doesn’t match, so it prints in full,” Wiz researchers explained. Seconds after the job finishes, the attacker’s tool downloads the workflow log via the GitHub API using the user agent “gheist” and deletes the run. “Because the secrets leave through GitHub’s own API, there is no attacker domain or outbound connection to block,” the report noted.
Targeting Self-Hosted Runners
On October 19, 2026, a second variant of the tool introduced a job named sync-host to target self-hosted runners. This script searches the host filesystem, process environments, and mounted Docker containers for 31 different credential formats. Specifically, it hunts for cloud metadata, Kubernetes tokens, and API keys for AI providers like Anthropic, Hugging Face, Groq, and NVIDIA.
Who Is Behind the Activity
Researchers have not attributed the Gheist campaign to a single group, noting that the stolen tokens come from infostealer logs and past breaches like the March 2026 Trivy supply-chain compromise. Consequently, multiple criminal groups are abusing the same pool of accounts simultaneously. For instance, Wiz observed overlaps on the compromised accounts with cracked-software lures, cryptomining runners, the May 2026 Megalodon attack, and DPRK-linked PolinRider malware.
Impact and How to Stay Protected
Since July 28, 2026, GitHub has paused suspicious workflow runs in public repositories until a human collaborator approves them. Therefore, every public run in the Gheist GitHub campaign stalled safely at the approval stage. However, this safeguard does not cover private repositories or GitHub Enterprise Server. In several enterprise environments, attackers cloned private code and used stolen cloud keys hours later to enumerate AWS Secrets Manager.
Recommended Defense Steps
To defend against the Gheist campaign, security teams should hunt for branches matching ci-sync-* and audit logs showing deleted workflow runs from the “gheist” user agent. Furthermore, defenders can check AWS CloudTrail logs for OIDC role assumptions referencing ci-sync- branches. Finally, affected organizations must revoke compromised tokens, rotate all exposed secrets, and rebuild any self-hosted runners containing .gdmp_pat or .gdmp_sweep files.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
