GoKawiilWiz Research flags 'Gheist' campaign abusing stolen GitHub tokens to exfiltrate secrets
Wiz Research has tracked an ongoing campaign called Gheist, active since September 15, 2026, that uses compromised GitHub tokens to plant a malicious 'sync-check' workflow across repositories. The workflow base32-encodes repository secrets to bypass GitHub's log masking, prints them to a workflow log, then an automated process downloads and deletes the log within seconds. Wiz has found over 13,500 planted branches across more than 850 compromised accounts, including private and enterprise repositories, and reported the activity to GitHub.
GoKawiil's interpretation of the reporting above, not reported fact.
The technique exploits a gap in GitHub's secret-masking feature, which only hides values that appear verbatim in logs, suggesting other obfuscation methods could similarly evade detection on the platform. Wiz notes that roughly two-thirds of implicated accounts are no longer active on GitHub, which it says likely reflects a platform response, though the campaign appears to be continuing and adapting. The incident underscores risks for organizations relying on CI/CD secrets stored in GitHub Actions, particularly in private repos where a recent public-repo mitigation does not apply.
- Gheist uses stolen GitHub tokens to plant a 'sync-check' workflow that base32-encodes and exfiltrates repository secrets before deleting evidence.
- Wiz Research has identified over 13,500 malicious branches across 850+ compromised accounts, spanning personal and enterprise repositories.
- GitHub's recent control blocks the technique in public repos, but private repositories and enterprise environments remain vulnerable as the campaign continues.
YubiKey 5C NFC Security Key — With campaigns like Gheist exploiting stolen GitHub tokens, strengthening account security is critical. A YubiKey adds hardware-based two-factor authentication to your GitHub account, making it far harder for attackers to hijack your credentials even if a token or password leaks. It's a simple, durable way to lock down developer accounts against exactly this kind of token-abuse attack.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: wiz.io, 2026-10-25
Published there as: “Gheist campaign plants secret-dumping workflows using stolen GitHub tokens”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.