Threats · 5h ago
Wiz Research has recovered more than 13,500 branches planted by Gheist across 850-plus compromised GitHub accounts since tracking the campaign on September 15, 2026. GitHub controls have disrupted exploitation in public repositories, but Wiz reports continued successful activity in private repositories and enterprise environments.
The planted GitHub Actions workflow converts secrets to Base32 before printing them. GitHub masks secrets only when their exact stored values appear, so transformed values show up in workflow logs. Gheist retrieves those logs through GitHub’s own API and deletes the run; it also targets environment-scoped secrets, which can include production credentials. Wiz saw cloud credentials from one affected organization later used to enumerate AWS Secrets Manager.
If user or automation tokens can access private repositories in your organization, public-repository protections do not define the boundary: the token’s reach does. Credentials exposed in logs may also carry the impact into connected cloud systems.
1 source covering this story
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Wiz Blog
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach.
Part of the PlainSec briefing for 2026-10-25