Gheist campaign uses stolen GitHub tokens to leak repository secrets through Actions logs
Organisations running private repositories or GitHub Enterprise Server are not covered by GitHub's workflow hold, so they must check their own exposure.
A large automated campaign, which Wiz has named Gheist, is abusing stolen GitHub access tokens to push workflow files that dump repository secrets into Actions logs, then pull those logs down and delete the runs. Wiz has traced more than 13,500 planted branches across over 850 compromised accounts, reaching private repositories and GitHub Enterprise environments as well as personal projects. GitHub's hold on suspicious workflow runs covers only public repositories on github.com, so it did not catch the private-repository and Enterprise Server activity. Anyone whose repositories may have been touched should rotate every secret the repository could read, revoke the token that pushed the branch, and look for ci-sync- branches and deleted runs in their audit logs.
Why it matters
The campaign reaches private repositories and Enterprise Server environments, which GitHub's pause on suspicious runs does not cover, so the protection most users assume is absent for them. Because deleting the planted branch or run does not undo the exposure, a repository's secrets may already be in an attacker's hands even after the traces are gone. The campaign was still active and changing as of October 24, and most of the accounts involved are no longer available on GitHub, which makes it hard to trace the full scope from the outside.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.