Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Since September 15, 2026, the cybersecurity firm Wiz Research has been monitoring a new campaign known as Gheist. This malicious operation exploits compromised GitHub tokens by creating a workflow named sync-check in every repository accessible to each token. The purpose of this workflow is to print the repository's secrets into its own workflow log, download the log through the GitHub API, and delete the run immediately afterward. The attacker's tool can be identified by the user agent "gheist".

Wiz Research has identified over 13,500 planted branches from more than 850 compromised accounts, spanning from personal projects to enterprise organizations' private repositories. Although a recent GitHub control has been implemented to block the exploitation in public repositories, successful exploitation and subsequent activities have been observed in private repositories and GitHub Enterprise environments.

Approximately two-thirds of the implicated accounts are no longer available on GitHub, likely due to response activities. The attacker creates branches named ci-sync- followed by six random characters, adds a .github/workflows/sync-check.yml file with the message "ci: sync config," and triggers the workflow. Permissions set to {} do not restrict the secrets context, allowing the attacker to access production credentials even without the necessary permissions.

The tool can operate in two variants, distinguished by their branch names. Tool A uses a hexadecimal suffix and a plain payload, while Tool B employs a base36 suffix, introduces a timeout-minutes parameter (set to 6), and adds an environment matrix shortly after its initial run (on September 28). Tool B also appends an additional job named sync-host, which performs a recursive search of the host's directories for various token formats, private keys, .env files, Terraform state files, and shell history. This job is buggy and fails to collect certain token formats, such as GCP or Azure tokens.

GitHub has been holding potentially malicious workflow runs in public repositories until a collaborator approves them. However, this control does not apply to private repositories or GitHub Enterprise Server. In such environments, GitHub audit logs show the completion and deletion of runs on ci-sync-* branches by the gheist user agent, indicating that Actions executed without approval.

This campaign is believed to be linked to other malicious activities, such as the Lure repositories campaign (malware distribution) and free compute attempts through cryptomining. Additionally, some victims have been found to be infected with PolinRider and Megalodon malware. The compromised GitHub credentials were likely obtained from infostealers and earlier supply-chain compromises, such as the Trivy breach in March.