Gheist

Gheist Threat Actor Weaponizes GitHub Tokens to Steal Cloud Secrets in Supply Chain Attack

Security researchers have identified an active supply chain attack attributed to a threat actor operating under the name 'Gheist'. The campaign is weaponizing GitHub tokens to gain unauthorized access and exfiltrate cloud secrets and sensitive data from thousands of developer repositories. The attack leverages compromised or abused token permissions to infiltrate repositories and extract valuable cloud credentials, posing a significant risk to software supply chains and cloud infrastructure security.