Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
- ID
- 39476
- Status
- summarized
- Published
- 26 Oct 2026, 3:49 PM
- Fetched
- 26 Oct 2026, 6:29 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.5
- Created
- 26 Oct 2026, 6:30 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Wiz says a campaign it calls Gheist has used stolen GitHub tokens since September 15 to push branches named ci-sync- plus six random characters, plant Actions workflows that print repository secrets into logs, then download the logs and delete the runs. Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts, with successful runs in private repositories and GitHub Enterprise Server; GitHub's suspicious-workflow approval guard stopped every public-repo run Wiz checked but does not cover private repos or GitHub Enterprise Server. Deleting the branch or run does not undo the exposure: Wiz says to rotate every secret the repository could read and revoke the token that pushed the branch.
Why it matters
If you run GitHub Actions in private repos or GitHub Enterprise Server, do not rely on GitHub's public-repo workflow-approval safeguard: check for ci-sync-* branches, revoke the token that created them, and rotate every secret that repository could read, because removing the branch or run alone leaves the leaked values valid.
Discussion angle
What is your detection and rotation playbook if a ci-sync-* branch appears, and which long-lived GitHub tokens in your repos can still push workflows and read secrets?