Threat Pulse 62High
Gheist: stolen GitHub tokens used to dump private repo secrets
Severity 7ActiveconfirmedAI and software supply chainCloud and SaaS

An automated campaign used stolen tokens on 850+ GitHub accounts to plant 13,500+ branches with Actions workflows that print private repo secrets into logs, then download and delete the runs. Wiz says it uses no C2 server and is still evolving; GitHub changes have disrupted it.

What to do: Revoke old GitHub tokens, look for unknown branches and workflow runs, and rotate any secret a repo's Actions can read.

· 10 days ago · thehackernews.com
Sourcesthehackernews.comHelp Net Security
On X
@wiz_ioverifiedOct 26, 10:10 UTC

An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

Open on X
@DarkReadingverifiedOct 26, 18:34 UTC

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

Open on X
Why this score

Plan rubric with caps (verified sweep, Oct 26)

Back to the board

Updated Nov 5, 01:45 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.