An automated campaign known as Gheist has been actively exploiting stolen GitHub tokens to target private repositories and GitHub Enterprise environments. According to a report published on 26 October 2026 by cloud security firm Wiz, the campaign plants malicious workflows that print sensitive repository secrets directly into Actions logs. Security researchers first began tracking the automated activity on 15 September 2026, uncovering a widespread threat landscape affecting numerous accounts and private projects.
The campaign derives its name from the user agent gheist, which is transmitted with GitHub API requests. Wiz recovered more than 13,500 planted branches from over 850 compromised accounts across personal projects and private enterprise repositories. The malicious tooling creates a new branch, commits an unsigned workflow file, and triggers a run that base32-encodes environment variables and secrets to expose them in standard workflow output logs.
Technical analysis shows that the attack framework utilizes specific indicators, including files such as .github/workflows/sync-check.yml and run prefixes like ci-sync-. While GitHub maintains automated safeguards that pause suspicious workflow runs for public repositories, these built-in protections do not extend to private repositories or GitHub Enterprise Server installations. Around 19 October 2026, researchers observed an updated version of the tool specifically designed to target self-hosted runners, searching local machines for 31 different types of credentials.
Cloud security investigators and researchers continue to monitor the evolving techniques employed by the Gheist campaign against self-hosted runners and compromised accounts. The ongoing developments highlight the risks associated with exposed or stolen authentication tokens within software development pipelines. Organizations are urged to review their repository access controls and audit workflow logs for unauthorized modifications or unexpected execution patterns that match the identified indicators.
The impact of the Gheist campaign is significant for development teams and enterprise environments relying on automated continuous integration workflows. Because the malicious tool successfully extracts environment variables and secrets from private codebases, unauthorized actors can potentially gain deep access to connected cloud infrastructure and downstream services. The inability of standard public repository safeguards to protect private environments underscores the need for heightened vigilance and proactive security measures across enterprise software supply chains.
To mitigate potential compromise, security best practices dictate that every secret the affected repository could read must be immediately rotated, and the specific token that pushed the malicious branch must be revoked. Organizations should also utilize OpenID Connect so that workflows can authenticate using short-lived tokens instead of storing static cloud keys, and implement required reviewers for deployment environments to prevent jobs from reading secrets without proper authorization. As automated threats against developer infrastructure evolve, securing CI/CD pipelines remains a critical priority for maintaining overall organizational security.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
