Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign tracked as Gheist is leveraging stolen GitHub tokens to inject malicious workflows into repositories. These workflows are designed to print repository secrets into GitHub Actions logs, which attackers then download and subsequently delete to cover their tracks. The campaign has successfully compromised both private repositories and GitHub Enterprise environments. The analysis was conducted by cloud security company Wiz. A GitHub safeguard mechanism that pauses workflows is referenced as a partial mitigation. The attack method abuses legitimate GitHub Actions functionality to exfiltrate sensitive credentials and secrets. The use of stolen tokens allows attackers to authenticate and operate as legitimate users, making detection difficult. The campaign highlights risks associated with CI/CD pipeline security and secret management in GitHub environments.