Gheist: Stolen GitHub Tokens Used to Inject Secret-Stealing Actions Workflows
1. Basic Information Article: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles Source: Wiz Research Published: October 25, 2026 Original: Wiz Research Related Sources: GitHub: Environment Protection and Secrets , GitHub: Scope of Actions Secrets , GitHub: Workflow File Modification Permissions , Dark Reading , GitHub Workflow Protection Related Malware, Threat Groups, CVE,…
Gheist is a cyberattack campaign that exploits stolen GitHub tokens to inject malicious workflows into GitHub repositories, ultimately logging and exfiltrating sensitive secrets. According to Wiz Research, over 850 accounts and more than 13,500 malicious branches have been identified as compromised in this ongoing operation. Executions observed in public repositories were thwarted by GitHub's approval hold feature, while private repositories and GitHub Enterprise Server environments revealed completed and deleted workflow runs, along with subsequent AWS Secrets Manager enumeration using stolen credentials from the affected organization.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
