The Gheist attack campaign uses stolen GitHub tokens to steal private repository secrets via Actions logs

According to analysis by cloud security company Wiz, an automated attack campaign named Gheist uses stolen GitHub tokens to plant workflows into repositories, printing repository secrets in base32 encoding into GitHub Actions logs, deleting the run records within seconds after download; the attack has succeeded in private repositories and GitHub Enterprise environments. Wiz has tracked the campaign since September 15 and has recovered more than 13,500 planted ci-sync- branches from more than 850 compromised accounts; since July 28, GitHub has suspended suspicious workflow runs pending approval as a protection, which blocked all public repository runs Wiz examined, but it does not cover private repositories and GitHub Enterprise Server. Sources of the stolen tokens include infostealer logs and tokens exposed by supply chain attacks such as the March compromise of the Trivy vulnerability scanner.