Gheist Campaign Uses GitHub Tokens to Expose Private Repository Secrets
A campaign tracked by Wiz is planting workflows in repositories accessible to stolen GitHub tokens and extracting secrets through Actions logs. Private repositories and GitHub Enterprise Server are not covered by GitHub’s current approval safeguard.