# Gheist turns stolen GitHub tokens into secret dumps through Actions logs

Source: https://startwithidentity.com/blog/2026-10-25-gheist-turns-stolen-github-tokens-into-secret-dumps-through-actions-logs/
Last updated: 2026-10-25
License: content by Start with Identity. Cite the source URL.

---

[Wiz](https://startwithidentity.com/vendors/ciem/wiz/) said on October 25 that an automated campaign it calls Gheist had planted more than 13,500 branches from more than 850 compromised GitHub accounts, from personal projects to enterprise private repositories. The tokens trace to infostealer logs and to leaks from earlier supply-chain attacks such as the March Trivy compromise. For each repository a token can write to, the tool creates a `ci-sync-` branch with a single `.github/workflows/sync-check.yml` file and the message "ci: sync config". The workflow prints the job environment and every reachable secret in base32, which GitHub's log masking does not catch, then the tool downloads the log through the API and deletes the run within seconds. One version also runs a job per deployment environment to reach production secrets. GitHub's approval hold stopped public-repo runs, but Wiz reports successful runs in private repositories and on GitHub Enterprise Server.

## Why it matters

Write access to a repository is read access to every secret its workflows can see, so a stolen developer token is effectively a stolen copy of production credentials. There is no attacker server to block: the secrets leave through GitHub's own API. In one enterprise, cloud credentials from the same organization were used against [AWS Secrets Manager](https://startwithidentity.com/vendors/secrets/aws-secrets-manager/) hours later.

Search for `ci-sync-` branches, runs deleted within a minute of finishing, and the `gheist` user agent in audit logs. Check cloud logs for role assumptions whose OIDC subject names a `ci-sync-` branch. If you find one, rotate every repository, organization and environment secret, revoke the pushing tokens, and check their owners for [infostealer infections](https://startwithidentity.com/techniques/infostealer-credential-harvesting/). Require reviewers on production environments, restrict OIDC trust to protected branches, and replace personal access tokens with GitHub Apps or short-lived fine-grained tokens. Compare the earlier [GhostAction wave](https://startwithidentity.com/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/).

Source: [Wiz](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles)