Gheist turns GitHub Actions into a secret extraction service

The Gheist campaign has compromised over 850 GitHub accounts and planted more than 13,500 malicious branches since September 15. Its sync-check workflows base32-encode secrets to bypass log masking, pull them via GitHub's API and delete the runs; GitHub's new approval control blocks only public repositories.

• Over 13,500 malicious branches across 850+ compromised GitHub accounts
• Secrets are base32-encoded to evade GitHub Actions log masking
• GitHub's mitigation covers public repos only, not private or Enterprise Server
• Wiz advises hunting ci-sync- branches and rotating all exposed secrets