Gheist abuses stolen GitHub tokens to plant secret-stealing workflows
What happened
Wiz Research has tracked an attack campaign called Gheist since September 15, 2026, according to an October 26 report. Attackers abused stolen GitHub tokens to commit a workflow named sync-check to every repository they could reach. The workflow printed repository secrets into run logs; the attackers then downloaded the logs through the GitHub API and deleted the run records. Wiz says it recovered more than 13,500 planted branches from over 850 compromised accounts, showing how the campaign used stolen tokens to reach repositories and steal secrets, and at what scale.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageGheist campaign plants secret-dumping workflows using stolen GitHub tokens
Wiz Research 自 2026 年 9 月 15 日起追踪到 Gheist 攻击活动，滥用被盗 GitHub token 向每个可访问仓库提交名为 sync-check 的工作流，将仓库密钥打印进日志再经 GitHub API 下载并删除运行记录，已从 850 多个失陷账号中恢复逾 13,500 个植入分支。
Heat over time
Not enough continuous observations to draw a trend yet.