GoKawiilWiz Research flags 'Gheist' campaign abusing stolen GitHub tokens to exfiltrate secrets
Wiz Research has tracked an ongoing campaign called Gheist, active since September 15, 2026, that uses compromised GitHub tokens to plant a malicious 'sync-check' workflow across repositories. The workflow base32-encodes repository secrets to bypass GitHub's log masking, prints them to a workflow log, then an automated process downloads and deletes the log within seconds. Wiz has found over 13,500 planted branches across more than 850 compromised accounts, including private and enterprise repositories, and reported the activity to GitHub.