Gheist Campaign Uses GitHub Tokens to Expose Private Repository Secrets
A campaign tracked by Wiz is using stolen GitHub tokens to plant workflows that expose repository secrets through GitHub Actions logs. The activity has succeeded in private repositories and GitHub Enterprise environments, and Wiz said it was still running as of October 24. For affected organizations, the immediate concern is not only the stolen GitHub token but every secret that a compromised repository could read.
The campaign creates a branch named ci-sync- followed by six random characters and adds .github/workflows/sync-check.yml. Pushing the branch starts a workflow that prints the job environment and readable secrets, encoding them in base32 before the operator downloads the Actions log and deletes the run. GitHub's masking does not reliably protect values after they have been changed in this way. Deleting the branch or run therefore does not undo an exposure.
The reported scale is substantial, although the available analysis does not establish how many organizations actually exposed secrets. Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts, including accounts connected to personal projects and enterprise repositories. In some enterprise cases, the stolen tokens were used to clone private repositories, while AWS logs showed workflows on the planted branches assuming cloud roles.
GitHub's suspicious-run safeguard does not cover every environment. It held the public-repository runs checked by Wiz, but GitHub says the feature currently applies to public repositories on github.com only; GitHub Enterprise Server does not have it at this time. A held run should not be approved, and code from a ci-sync branch should not be executed.
Administrators can start by searching for ci-sync- branches with six characters, a sole sync-check workflow and the commit message ci: sync config. Audit logs should also be checked for runs on those branches that finished and were deleted within a minute, as well as activity from the gheist user agent. Where workflows use cloud OIDC, cloud audit logs can reveal role assumptions or token exchanges whose subject includes a ci-sync- branch, even without GitHub logs.
If a matching branch or run is found, Wiz advises rotating every repository, organization and environment secret that the repository could use, then revoking the tokens that pushed the commits. If the branch ran on a self-hosted runner, the machine and its cloud instance role should be treated as compromised. Organizations should also check the token owners' devices for infostealers. Longer-term measures in the analysis include requiring reviewers for environments holding production secrets and restricting OIDC trust to protected branches or environments.