Security · Updated 26 Oct, 01:19 pm IST
Gheist campaign uses stolen GitHub tokens to exfiltrate repo secrets
Why it matters for readers: The attack shows how CI systems and stolen API tokens can be combined to quietly steal sensitive project data.
- Attackers use stolen GitHub tokens to create branches and plant workflows that print repository secrets into GitHub Actions logs.1
- The campaign has succeeded in private repositories and on GitHub Enterprise Server, where GitHub's public-run safeguards do not apply.1
- Wiz has tracked the activity since September 15 and recovered over 13,500 planted branches from more than 850 compromised accounts.1
- GitHub's safeguard that pauses suspicious workflow runs stopped the public-repository runs Wiz checked, but it does not cover private repos or GitHub Enterprise Server.1
- Deleting a branch or the run does not undo the exposure; affected repositories should rotate every secret and revoke the pushing token.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started