Gheist Campaign Exploits Stolen GitHub Tokens to Exfiltrate Private Repository Secrets

An automated campaign attributed to the threat actor Gheist is exploiting stolen GitHub tokens to exfiltrate private repository secrets via GitHub Actions logs, according to an analysis by cloud security firm Wiz. The attack chain begins with compromised or stolen GitHub tokens, which the actor uses to plant or modify malicious workflows within target repositories. These workflows are engineered to output repository secrets—including API keys, tokens, and other credentials—to the GitHub Actions log output. Once the secrets are captured in the logs, the attackers download the log data and then delete the specific workflow runs. This deletion step is intended to remove evidence of the exfiltration and evade detection by repository owners and security monitoring tools.

Wiz reports that the campaign has successfully targeted private repositories and GitHub Enterprise environments, indicating a broad scope of potential impact. The ability to operate within Enterprise environments suggests the attackers may have bypassed certain organizational security controls or obtained tokens with sufficient scope to modify workflows at an organizational level.

In response, GitHub has implemented safeguards that pause workflows when they attempt to print secrets to logs. The company has also advised organizations to rotate any potentially compromised tokens, review workflows for unauthorized modifications, and enforce least-privilege token scopes to minimize the risk of similar exploits.

The incident highlights the risks associated with over-privileged GitHub tokens and the importance of monitoring workflow modifications and log output for sensitive data exposure.