Since September 15, 2026, Wiz Research has tracked Gheist, a campaign abusing compromised GitHub tokens to exfiltrate secrets. The attack plants a workflow named sync-check in every accessible repository, encoding secrets in base32 to bypass log masking. Over 13,500 branches were planted across 850+ accounts, including enterprise environments.
Despite GitHub blocking public repo exploitation, private and enterprise repos remain vulnerable. The tool uses the user agent 'gheist' and deletes logs via API after extraction. Two variants exist: Tool A (hex suffix) and Tool B (base36 suffix), with Tool B evolving to include environment matrices, self-hosted runner targeting, and recursive credential harvesting.
It searches for 31 token formats, including AI provider keys, cloud credentials, and Kubernetes tokens. The campaign remains active as of October 24, with roughly two-thirds of implicated accounts no longer on GitHub.
Source: Hacker News · Summarized by HeadlinesBriefing