Wiz Research analysis reported October 27, 2026; campaign tracked since September 15, 2026
Gheist Turns Stolen GitHub Tokens Into a Pipeline for Private Repository Secrets
Wiz Research has recovered more than 13,500 planted branches from more than 850 compromised GitHub accounts in an automated campaign it calls Gheist, after the user agent the attackers' tool sends with GitHub API requests. The tool takes a stolen token, walks every repository the token can reach, and plants one workflow file, .github/workflows/sync-check.yml, on a new branch named ci-sync- followed by six random characters, with the commit message 'ci: sync config'. The workflow prints the repository's secrets into its Actions run log encoded in base32, which defeats GitHub's log masking because the encoded text no longer matches the stored secret; the tool then downloads the log through the GitHub API and deletes the run within seconds, so the secrets leave through GitHub itself with no attacker server to block. A GitHub safeguard that holds suspicious workflow runs for approval stopped every public-repository run Wiz checked, but it does not cover private repositories or GitHub Enterprise Server, where runs completed and were deleted. Wiz traced the stolen tokens to infostealer logs and to tokens exposed in earlier supply-chain incidents, including the March compromise of the Trivy scanner. In enterprise organizations the tool cycled through several users' and automation accounts' tokens within minutes and cloned private repositories first; hours later, cloud credentials from the same organization were used to enumerate AWS Secrets Manager, though Wiz does not say where those credentials came from. A variant added on October 19 targets self-hosted runners; Wiz calls that job buggy and reports no successful run.
Executives
One stolen developer token quietly became read access to every secret in every repository that token could open, including production credentials held in private projects. The control question is about token hygiene at scale: how many long-lived personal access tokens exist across your engineering organization, what can each one reach, and when did anyone last inventory them.
CIO / CISO
Run the Wiz checks this week: search for ci-sync- branches, for workflow runs on those branches deleted within a minute of finishing, and for the gheist user agent in GitHub audit logs; for OIDC-connected workflows, search cloud logs for role assumptions whose subject includes a ci-sync- branch. Where a run completed, rotate every repository, organization, and environment secret the repository could use and revoke the pushing token, because deleting the branch does not undo the exposure. That rotation discipline is the ISO 27001 access control and supplier management program operating as designed.
Engineers
Prefer GitHub Apps or short-lived fine-grained tokens over personal access tokens, require reviewers on environments that hold production secrets, and limit OIDC trust policies to protected branches or environments. Treat self-hosted runners as short-lived machines without Docker socket access or open routes to cloud metadata, and check runner hosts for the files .gdmp_pat, .gdmp_patg, and .gdmp_sweep.
Everyone (non-IT)
If you write code, a token saved on your laptop is a key to your employer's systems, not a personal convenience. Keep tokens out of files and browser storage where infostealer malware looks first, and tell your security team if a repository you own suddenly has a branch you did not create.