Wiz uncovers Gheist campaign abusing 850 stolen GitHub accounts

Wiz Research detailed Gheist, a campaign using stolen GitHub tokens to inject workflows that exfiltrate secrets into Actions logs. It identified over 850 compromised accounts and 13,500 malicious branches; public-repo runs were blocked by GitHub's approval hold, while private and GHES environments saw completed runs and AWS Secrets Manager enumeration.

• Wiz identified more than 850 compromised GitHub accounts
• Attackers created over 13,500 malicious branches prefixed ci-sync-
• The sync-check.yml workflow base32-encoded secrets into Actions logs
• Private repos and GHES saw completed runs and AWS Secrets Manager enumeration