Gheist campaign turns stolen GitHub tokens into Actions secret dumps

Wiz reported on October 25, 2026 that an automated campaign it tracked from September 15 used stolen GitHub tokens, traced to infostealer logs and earlier supply-chain leaks such as the March Trivy compromise, to commit a sync-check workflow to every repository each token could reach. The workflow printed the repository's secrets into its own log, which the tool downloaded through the GitHub API before deleting the run. GitHub's approval hold stopped runs in public repositories, but Wiz saw successful runs in private repositories and on GitHub Enterprise Server, including workflows assuming AWS roles from attacker branches.

Victim

Multiple: more than 850 compromised GitHub accounts and the repositories they could write to

Industry

Technology

Country

Global

Intrusion began

Sep 15, 2026

First disclosed

Oct 25, 2026

Actor

Gheist operators (unattributed) (Unattributed)

Initial access

Stolen credentials

Identity control that failed

Credential storage

MFA

Not applicable (no interactive login)

Abused identity

Non-human (service account, token, key or app)

Records affected

Not disclosed

Disclosed cost

Not disclosed