Wiz Research has disclosed a campaign it calls Gheist, in which attackers use stolen GitHub tokens to extract repository secrets from more than 850 compromised accounts. The firm recovered over 13,500 malicious branches, ranging from personal projects to private enterprise repositories, and said the campaign was still active on October 24.
Wiz has tracked the activity since September 15 and named it after the “gheist” user agent that appears in the attackers’ GitHub API calls.
How the Gheist Tool Prints Secrets Into Workflow Logs
With a stolen token, the tool creates a branch named ci-sync- followed by six random characters. It then commits a file at .github/workflows/sync-check.yml with the commit message “ci: sync config.” That workflow prints the repository’s secrets into the run log. The tool downloads the log through the GitHub API and deletes the run seconds later.
The attackers encode secrets in base32, which evades GitHub’s log masking. Wiz noted that the method needs no attacker-controlled server.
A Second Variant Hunts 31 Credential Formats on Self-Hosted Runners
A second variant, seen on October 19, adds a “sync-host” job aimed at self-hosted runners. It searches for 31 credential formats, including cloud metadata, Kubernetes tokens and API keys for AI providers such as Anthropic, Hugging Face, Groq and NVIDIA.
GitHub Safeguard Stops Public Runs but Not Private Repositories
On July 28, GitHub introduced a safeguard that holds suspicious workflow runs in public repositories until a collaborator approves them. Wiz said it stopped every public run the firm checked. The protection does not cover private repositories or GitHub Enterprise Server, where the malicious workflows ran to completion.
Enterprise Intrusions Showed Rapid Token Cycling and AWS Secrets Manager Enumeration
In enterprise organizations, the tool cycled through tokens belonging to several users and automation accounts within minutes and cloned private repositories. Hours later, cloud credentials from the same organization were used to enumerate AWS Secrets Manager. Wiz does not say where those credentials came from.
Token Sources Point to Infostealers and Earlier Supply Chain Compromises
Wiz traced the stolen tokens to infostealer logs and earlier supply-chain compromises, including the March 2026 Trivy compromise. Multiple groups appear to draw from the same token pool, and some of the accounts were also used for malware distribution and cryptomining. Wiz did not attribute the campaign to a single actor.
About two-thirds of the involved accounts were no longer on GitHub when Wiz reviewed them. The firm did not state how many organizations have exposed secrets.
Why Deleting Branches and Runs Does Not Reverse the Exposure
Because the tool retrieves the log and removes the run within seconds, a repository owner reviewing run history later may find nothing. Deleting the ci-sync- branches does not undo the exposure of secrets that were already printed and downloaded. Wiz advises rotating every secret the repository could read, revoking the token used to push, and checking audit logs for ci-sync- branches and for runs deleted under the gheist user agent.
The reuse of one token pool by several groups means that a credential stolen by an infostealer months ago can resurface in a new campaign, and the Gheist findings tie the March Trivy compromise to activity that was still running in late October.
Timeline of Gheist From the July Safeguard to Late October
The sequence of events shows how the campaign developed around GitHub’s defenses. GitHub added its safeguard for public repositories on July 28. Wiz began tracking the activity on September 15. The second variant, with the sync-host job for self-hosted runners, appeared on October 19, and the campaign was still active on October 24 and 25, when Wiz published its findings.
The impact falls on cloud and CI secrets stored in private enterprise repositories. In the cases Wiz observed, the pattern of token cycling, repository cloning and later use of cloud credentials against AWS Secrets Manager shows how access to a repository can lead to access to the cloud accounts behind it. Wiz says the scale of exposure beyond the 850 accounts remains unknown because it did not state how many organizations have exposed secrets.
