Gheist Campaign Uses Stolen GitHub Tokens to Expose Repository Secrets

Summary

Wiz Research reports that Gheist used compromised GitHub tokens to plant workflows and expose repository secrets, recovering more than 13,500 branches across 850+ accounts. Public runs were held for approval, but private and enterprise runs executed.

Key points

Wiz Research says it recovered more than 13,500 planted branches across more than 850 accounts; the campaign was ongoing as of October 24, 2026.
The tool plants a sync-check workflow on branches named ci-sync- plus six characters. Base32 encoding bypasses GitHub's masking of secrets in workflow logs; the tool retrieves logs via the GitHub API and deletes runs shortly afterward.
Deployment-environment matrices can expose environment-scoped secrets. Wiz reports that private repositories and GitHub Enterprise Server were affected despite a GitHub approval hold preventing the public runs it checked from executing.
Wiz cites GitHub audit logs and CloudTrail evidence of private or enterprise workflow runs completing and assuming AWS roles from attacker-created branches.
A later self-hosted-runner job searched for credentials and sensitive files, inspected process environments and Docker-mounted host filesystems, and sought cloud and runner credentials; Wiz says the job had collection bugs.
Wiz recommends rotating accessible secrets and revoking pushing tokens, investigating affected devices and self-hosted hosts, and restricting environment approvals, OIDC trust, token scope, and runner access.

Article Details

Attack Vectors: Gheist uses compromised GitHub tokens to create a branch and push a workflow to every accessible repository. The push triggers a workflow that base32-encodes repository secrets so they are not masked in logs.
The operator retrieves workflow logs through the GitHub API and deletes the completed run shortly afterward. Deployment-environment secrets may also be exposed through an environment matrix.
In private repositories and GitHub Enterprise Server, the workflow ran without the public-repository approval hold. In observed enterprise activity, cloud credentials from the same organization were later used to enumerate AWS Secrets Manager.
A Tool B variant added a self-hosted-runner job that searched host files, process environments, runner credentials, and cloud metadata. It also attempted to use the Docker socket to search the host filesystem from a container.
Defensive Notes: Hunt for ci-sync- branches with six-character suffixes, the .github/workflows/sync-check.yml file, the commit message ci: sync config, and workflow runs deleted shortly after completion.
Check GitHub audit logs for the gheist user agent and cloud audit logs for role assumptions or token exchanges whose subject includes a ci-sync- branch.
On self-hosted runners, look for .gdmp_pat, .gdmp_patg, .gdmp_sweep, and gdmp-pivot in job logs.
Rotate repository, organization, and environment secrets accessible to affected repositories; revoke tokens that pushed the commits and check their owners' devices for infostealers.
Treat a self-hosted runner and its instance role as compromised if a ci-sync branch ran there. Do not approve held sync-check runs or run code from ci-sync branches.
Require reviewers for environments containing production secrets, scope OIDC trust policies to protected branches or environments, prefer GitHub Apps or short-lived fine-grained tokens over personal access tokens, and use ephemeral self-hosted runners without Docker socket or unrestricted metadata access.

Indicators of compromise

Type	Indicator	Context
IPV4	`193[.]32[.]204[.]199`	Reported secret-exfiltration destination for the distinct GhostAction campaign, not Gheist.
SHA1	`1dc5af9cce950aad1eb1546ecce8565b117540c4`	Workflow blob SHA identified for a Gheist payload variant with a separator.
SHA1	`c665b778b2d822453293003e7ca0bbb2cb08e39d`	Workflow blob SHA identified for the Gheist self-hosted job.
SHA1	`d09535857a741bbb976bdc084a9a021713133291`	Workflow blob SHA identified for a Gheist payload variant with a timeout.
SHA1	`f3da2b8b357dcda02fd455d314be2a95007516a6`	Workflow blob SHA identified for the plain Gheist payload.

MITRE ATT&CK

Malware

PolinRiderPolinRider. Some victims appear to be infected with PolinRider, the DPRK-linked malware that hides JavaScript in build config files and force-pushes back-dated commits.

Vendors

Amazon Web Servicesplanting the workflow, and hours later, cloud credentials from the same organization used to enumerate AWS Secrets Manager.GitHub15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has WizSince September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token

Products

AWS Secrets Managerthe workflow, and hours later, cloud credentials from the same organization used to enumerate AWS Secrets Manager.CloudTrailaudit logs show runs on ci-sync-* branches completing and then being deleted by the gheist user agent. CloudTrail shows the organizations' own workflows running on those branches and assuming AWS roles, which proves DockerThrough the Docker socket, a container with the host's root filesystem mounted, to repeat the search on the host.GitHub ActionsGitHub Actions and GitLab runner credential files.GitHub Enterprise ServerUnfortunately, that hold doesn't apply to private repositories or GitHub Enterprise Server. There, GitHub audit logs show runs on ci-sync-* branches completing and then being deleted by the gheist user agent. CloudTrail Wiz Defendcommits, Gheist activity in GitHub audit logs and cloud role assumptions from attacker branches. Wiz Defend detects the activity with rules including "New Workflow Completed And Deleted In Short Time Span",