{
  "id": 16681437,
  "title": "Gheist: Stolen GitHub Tokens Used to Inject Secret-Stealing Actions Workflows",
  "url": "https://urgent.news/2026/10/27/gheist-stolen-github-tokens-used-to-inject-secret-stealing-actions",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T00:29:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/gheist-stolen-github-tokens-used-to-inject-secret-stealing-actions-workflows-1g7c"
  },
  "original_language": "en",
  "account": "Gheist is a cyberattack campaign that exploits stolen GitHub tokens to inject malicious workflows into GitHub repositories, ultimately logging and exfiltrating sensitive secrets. According to Wiz Research, over 850 accounts and more than 13,500 malicious branches have been identified as compromised in this ongoing operation. Executions observed in public repositories were thwarted by GitHub's approval hold feature, while private repositories and GitHub Enterprise Server environments revealed completed and deleted workflow runs, along with subsequent AWS Secrets Manager enumeration using stolen credentials from the affected organization.",
  "summary": "1. Basic Information Article: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles Source: Wiz Research Published: October 25, 2026 Original: Wiz Research Related Sources: GitHub: Environment Protection and Secrets , GitHub: Scope of Actions Secrets , GitHub: Workflow File Modification Permissions , Dark Reading , GitHub Workflow Protection Related Malware, Threat Groups, CVE,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Hacker News",
        "title": "Gheist campaign plants secret-dumping workflows using stolen GitHub tokens",
        "url": "https://urgent.news/2026/10/25/gheist-campaign-plants-secret-dumping-workflows-using-stolen-github",
        "published": "2026-10-25T19:10:36.000Z"
      },
      {
        "outlet": "The Hacker News",
        "title": "Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs",
        "url": "https://urgent.news/2026/10/26/gheist-uses-stolen-github-tokens-to-steal-private-repository-secrets",
        "published": "2026-10-26T07:49:46.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}