Gheist campaign plants secret-dumping workflows using stolen GitHub tokens
A security campaign dubbed 'Gheist' has compromised over 850 GitHub accounts to inject malicious workflows into repositories. The attackers use stolen tokens to extract secrets by printing them into workflow logs, bypassing standard security masks.
Why it matters
This attack highlights a significant vulnerability in CI/CD pipelines, potentially exposing sensitive production credentials for both personal and enterprise projects.
Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has access. The workflow seeks to print the repository's secrets into its own workflow log. Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent gheist , which gives the campaign its name.
We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories.
A recent GitHub control has been blocking the exploitation in public repositories, but we've observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in