Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs
Beginning September 15, 2026, an automated threat campaign tracked as Gheist began exploiting stolen GitHub personal access tokens to plant malicious GitHub Actions workflows inside private repositories and GitHub Enterprise environments. The attacker tool created ci-sync- branches, committed a workflow that printed all accessible secrets encoded in base32 to bypass GitHub's masking, downloaded the logs via API, and deleted the run within seconds—leaving no outbound connection to block. Wiz researchers recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations, with post-compromise activity including AWS Secrets Manager enumeration and lateral credential reuse. Gheist exemplifies an accelerating class of CI/CD supply-chain attacks where the pipeline itself becomes the exfiltration channel. With tokens sourced from infostealer markets and prior supply-chain breaches, attackers require no vulnerability—only write access. As enterprises expand GitHub Actions usage for cloud deployments, the blast radius of a single stolen token now reaches production cloud credentials, making pipeline identity governance a board-level concern.
Kill Chain
