Gheist Used 850 Stolen GitHub Tokens to Print Secrets Into Workflow Logs

An automated campaign Wiz Research calls Gheist has used stolen GitHub tokens (credentials that let a script act as a user) to push a secret-dumping workflow into repositories on more than 850 accounts, Wiz said in a report published this week. The attacker needs only a valid token, not a software flaw, and in private repositories nothing in GitHub's default settings stopped the workflow from running.

Wiz has tracked the activity since Sept. 15, 2026. As of Oct. 24 it had recovered more than 13,500 planted branches. The name comes from the user agent gheist that the tool's API requests carry.

How a branch called ci-sync becomes a secret leak

For each repository a token can reach, the tool creates a branch named ci-sync- plus six random characters. It commits .github/workflows/sync-check.yml with the message ci: sync config, unsigned and authored as the token's owner.

The push triggers a workflow that prints the environment and base32-encoded secrets to the job log. Base32 matters because GitHub masks a secret only when it appears verbatim, and an encoded copy does not match. The tool then downloads the log through the API and deletes the run seconds later.

Wiz also found that permissions: {} does not restrict the secrets context, and that a job matrix over deployment environments exposes environment-scoped secrets, which are often production credentials. Because everything leaves through GitHub's own API, there is no attacker domain to block.

What GitHub's July 28 hold stopped, and what it did not

On July 28, 2026, GitHub began holding workflow runs it flags as potentially malicious until a collaborator with write access approves them. The protection covers public repositories on github.com only, and GitHub says Enterprise Server does not get it.

Wiz found every public Gheist run sitting at action_required. In its words, "The control worked, and the malicious payloads never ran." In private repositories the audit logs show runs completing and being deleted, and AWS CloudTrail shows organizations' workflows assuming AWS roles on attacker branches.

In enterprise organizations the tool cycled through the tokens of several users and automation accounts within minutes and cloned private repositories. Hours later, cloud credentials from the same organization were used to enumerate AWS Secrets Manager.

Two payload generations

Variant	Branch suffix	Added	First seen
Tool A	Hexadecimal	Plain secret dump	Sept. 15 (tracking start)
Tool B	Base36	Six-minute timeout, environment matrix	Sept. 28
Tool B, later	Base36	Base32 separator (Oct. 19), sync-host job for self-hosted runners	Oct. 19 onward

The sync-host job searches for tokens, private keys and .env files, tries Docker-socket access and queries cloud metadata. Wiz calls it buggy: it looks for the wrong runner key file, its URL-credential regex is broken, and it collects no GCP or Azure tokens.

Where the tokens likely came from

Wiz says the likely sources are infostealer logs and tokens exposed in earlier supply-chain compromises, such as the March Trivy compromise. It found 57 Gheist first-phase accounts that were also victims of the Megalodon campaign in May, and some victims carried the DPRK-linked PolinRider malware. Wiz says Gheist is distinct from GhostAction, which uses different workflow files and a separate exfiltration IP address.

Roughly two-thirds of the implicated accounts are no longer available on GitHub, which Wiz says "likely indicates response activity"; it has reported the activity to GitHub. The first-phase timing recalls a pattern we saw when Nextcloud's built-in Collabora server was attacked for four weeks before its CVE existed: defenders learned of it from telemetry, not an advisory.

What to do

Search for branches matching ^ci-sync-[0-9a-z]{6}$ and for workflow runs deleted within a minute of finishing. Rotate every secret reachable from affected repositories, revoke the tokens that pushed the commits, and treat any self-hosted runner that executed a ci-sync branch as compromised. Do not approve held sync-check runs. As with the case where a vendor patch was not the fix, rotation matters more than cleanup. Wiz recommends required reviewers on production environments, OIDC trust scoped to protected branches, and ephemeral self-hosted runners without Docker-socket access.

Wiz's Threat Center advisory is numbered wiz-adv-2026-186. Wiz says the campaign is ongoing and still changing.