Wiz found more than 13,500 planted branches across over 850 compromised accounts and says attacks succeeded in private repositories. It advises affected owners to replace accessible secrets and revoke the tokens used.
An automated campaign called Gheist uses stolen GitHub access tokens to make repositories print stored credentials into GitHub Actions job logs, cloud security company Wiz says. Attackers download those logs and delete the runs seconds later. Wiz says the attacks succeeded in private repositories and GitHub Enterprise environments.
Wiz has tracked Gheist since September 15. Its findings, described by The Hacker News on October 26, include more than 13,500 planted branches across over 850 compromised accounts. These range from personal projects to enterprise repositories. Wiz has not given a count of organisations whose secrets were exposed.
Access tokens are credentials that let software act on an account’s behalf. GitHub’s documentation says repository write access allows access to its configured secrets, such as passwords and cloud keys. Gheist uses a stolen token with that access to create a branch—a separate line of changes—and add an automated workflow.
The workflow prints every secret its job can read using base32, a way to represent data as text rather than encrypt it. GitHub normally hides secrets in logs, but its documentation warns that this protection is not guaranteed after a value changes format. Wiz says the encoded text no longer matches the original secret, so it appears in full.
One variant also creates jobs for deployment environments, which can hold separate credentials for systems such as production services. The attackers retrieve the logs through GitHub’s software interface, then delete the runs. The theft therefore uses GitHub itself, rather than a separate attacker server that defenders could block.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Since July 28, GitHub has paused workflow runs it identifies as potentially malicious until a collaborator with write access approves them. Every public-repository Gheist run Wiz checked remained awaiting approval, so those payloads did not execute. The safeguard applies only to public repositories on github.com—not private repositories or GitHub Enterprise Server—and only catches runs GitHub flags.
In private repositories and on Enterprise Server, Wiz observed audit records showing runs on the planted branches completing and then being deleted by a tool identifying itself as gheist. Wiz says Gheist is distinct from GhostAction, a separate campaign that uses different workflow files.
Around October 19, a Gheist variant added a job targeting self-hosted runners: machines organisations operate themselves to process GitHub Actions jobs. That job searches the machine for credentials. Wiz described it as buggy and reported no successful run.
Wiz said Gheist remained active and was changing as of October 24. It recommends checking for these signs:
Deleting a branch or run does not undo exposure. Wiz advises affected owners to replace every repository, organisation and deployment-environment secret the repository could access, revoke the tokens that pushed the commits, and check the token owners’ devices for credential-stealing malware. Owners should not approve held sync-check runs or execute code from ci-sync branches.
If a malicious branch ran on a self-hosted runner, Wiz advises treating the machine and its associated cloud permissions as compromised. To limit future exposure, it recommends requiring reviewers for environments holding production secrets. GitHub’s documentation says a job cannot read those environment secrets until a required reviewer approves it.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
