Gheist Campaign Uses Stolen GitHub Tokens to Harvest Cloud Secrets
Summary
Wiz says the active Gheist campaign used stolen GitHub tokens to add Actions workflows that exposed repository secrets in logs, affecting more than 850 accounts and 13,500 branches, including private repositories and enterprise environments.
Key points
- Wiz reported more than 13,500 malicious branches across more than 850 compromised GitHub accounts; it tracked the activity from Sept. 15 and said it remained active and evolving as of Oct. 24.
- Attackers used stolen tokens to create branches named “ci-sync-” followed by six characters and add a “sync-check” GitHub Actions workflow.
- The workflow attempts to print environment variables and repository secrets into its log; the attackers encode the output with Base32, retrieve the log through the GitHub API, then delete the workflow run seconds later.
- Wiz said the tokens appeared to come mainly from infostealer malware and credentials exposed in earlier software supply-chain compromises.
- Wiz observed successful attacks in private repositories and enterprise environments. It also reported private-repository cloning and subsequent use of cloud credentials to enumerate AWS Secrets Manager.
- Wiz estimated the campaign affected about a dozen companies, while noting it had not seen consistent or automated abuse beyond mass repository cloning and core credential theft.
- Wiz advised hunting for the named branch and workflow patterns, reviewing audit logs for quickly deleted runs and the “gheist” user agent, rotating exposed secrets, and using short-lived, fine-grained credentials.
Article Details
- Attack Vectors
- Attackers used compromised GitHub tokens to access repositories, clone private repositories, and create branches containing a malicious GitHub Actions workflow.
- The workflow attempted to print repository secrets and environment variables into its run log; attackers retrieved the log through the GitHub API and deleted the workflow run.
- The report says cloud credentials obtained from the same organization were used to enumerate AWS Secrets Manager.
- Defensive Notes
- Hunt for branches named "ci-sync-" followed by six characters, especially when the only change is .github/workflows/sync-check.yml with commit message "ci: sync config."
- Review GitHub audit logs for workflow runs on "ci-sync-*" branches that were deleted within a minute of completion, and for activity using the user agent "gheist."
- Rotate exposed secrets and treat compromised self-hosted runners as potential infrastructure breaches.
- Replace long-lived personal access tokens with GitHub Apps or short-lived fine-grained tokens, and require reviewers for environments holding production secrets.
MITRE ATT&CK
T1078 · Valid AccountsThe campaign used stolen GitHub tokens to access repositories and perform actions as the token owners.T1213.003 · Code RepositoriesAttackers cloned private repositories accessible through compromised GitHub tokens.T1526 · Cloud Service DiscoveryThe researchers reported that cloud credentials from an affected organization were used to enumerate AWS Secrets Manager.T1567 · Exfiltration Over Web ServiceThe workflow logs containing secrets were retrieved through the GitHub API, which the researchers said avoided an attacker domain or outbound connection.
People
James MatchettHead of security at Cloudsmith who commented on the risks of compromised credentials and recommended scoped, short-lived credentials and rotation.Rami McCarthyWiz researcher who discussed the campaign's scope, affected environments, and observed activity.Waseem AhmedHead of engineering at Secure.com who recommended replacing long-lived personal access tokens and requiring reviewers for environments holding production secrets.
Vendors
Cloudsmithcarried full write authority," says James Matchett, head of security at supply chain security firm Cloudsmith, in an email interview. "'Private' is not a control. Scoped, short-lived credentials, a tight inventoryGitHubAn ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway intoSecure.comFor broader protection against GitHub token abuse, Waseem Ahmed, head of engineering at security firm Secure.com, recommends that organizations "replace long-lived personal access tokens with GitHub Apps or short-livedWiz— across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.
Products
AWS Secrets Managerworkflows. Within hours, cloud credentials from the same organization were used to enumerate AWS Secrets Manager, the researchers added.GitHub Actionsand other abuse campaigns, including repository-based malware distribution, attempts to exploit GitHub Actions for computing resources, and possible infections linked to other malware operations.GitHub Appsfirm Secure.com, recommends that organizations "replace long-lived personal access tokens with GitHub Apps or short-lived fine-grained tokens" and "require reviewers on any environment that holds production