Gheist plants 13,500 secret-stealing workflows across 850 compromised GitHub accounts
Wiz says the Gheist campaign has planted more than 13,500 branches across more than 850 compromised GitHub accounts, using stolen tokens to add workflows that encode repository secrets and print them in logs. GitHub’s approval control held every public-repository run Wiz checked, but the researchers found successful executions in private repositories and GitHub Enterprise environments, including AWS role assumptions.
Bottom line — Wiz says deleting a run does not undo exposure: affected teams should rotate accessible secrets and revoke the tokens that pushed the workflows.
Go deeper 6
-
Wiz says the workflow encodes secrets in Base32 to evade log masking, then retrieves the logs through GitHub’s API and deletes the run.
-
The campaign’s branch pattern is ci-sync- followed by six random characters; its reported commit message is “ci: sync config”.
-
Since 28 July 2026, GitHub has held potentially malicious workflow runs in public repositories for collaborator approval; private repositories and GitHub Enterprise Server are not covered by that hold, according to Wiz.
-
Wiz observed AWS role assumptions from attacker-created branches in CloudTrail, offering a detection route even without GitHub logs.
-
A newer variant targets self-hosted runners, searching for 31 types of credentials, including AI-provider keys; Wiz says the variant has technical flaws.
-
Wiz traced the stolen tokens to infostealer logs and credentials exposed in earlier supply-chain incidents, including the Trivy compromise.