What happened
Wiz Research uncovered a campaign called Gheist that abuses stolen GitHub personal access tokens. The tool enumerates every repository the token can access, creates a hidden branch, and pushes a malicious GitHub Actions workflow. The workflow scrambles each secret, bypasses GitHub’s log‑masking, prints the secrets to the run log, and downloads the log via the API before deleting the branch. Over 13,500 malicious branches were planted across 850+ compromised accounts, exposing environment‑scoped credentials and, in a later variant, targeting self‑hosted runners to harvest additional tokens. GitHub’s safeguard that holds workflow runs for public repos does not apply to private repositories or GitHub Enterprise Server, allowing the exfiltration to proceed unchecked.
Why it matters for trust and compliance
- The incident demonstrates a control‑objective failure in credential management and CI/CD workflow approval, highlighting the need for continuous monitoring and strict token hygiene.
- Implement continuous monitoring of token usage and workflow approvals to satisfy access‑control objectives across frameworks.
- Collect audit‑log evidence of branch creation and workflow execution for audit readiness and incident response.
Who is affected
Technology SaaS platforms (GitHub users) Enterprises that store production secrets in private repositories
Recommended actions
- Adopt fine‑grained, short‑lived personal access tokens and enforce regular rotation.
- Require manual approval for all new GitHub Actions workflows, especially in private repos.
- Enable GitHub secret‑scanning and enforce branch‑protection policies.
- Monitor audit logs for anomalous branch creation and workflow runs.
- Restrict Docker and file‑system access on self‑hosted runners.