An automated campaign is using stolen GitHub tokens to plant a small workflow file in every repository each token can reach, then using GitHub's own machinery to print the repository's secrets and carry them away. Wiz Research, in a report by Rami McCarthy and Hila Ramati, says it has recovered more than 13,500 planted branches from more than 850 compromised accounts since it began tracking the activity on September 15, 2026.
Wiz calls the campaign Gheist, after the user agent string its API requests carry. Victims range from personal projects to private repositories belonging to enterprise organizations, and the researchers say the attack was still ongoing and evolving as of October 24.
A workflow that leaks secrets through its own log
For each repository, the tool creates a branch named ci-sync- plus six random characters and commits a file at .github/workflows/sync-check.yml with the message "ci: sync config". The push itself triggers the workflow, which dumps the job's environment and every repository secret into the run log, encoded in base32. GitHub masks secrets in logs only when they appear verbatim, so the encoded values print in full. The tool then downloads the log through the GitHub API and deletes the run seconds later.
Because the secrets leave through GitHub's API, there is no attacker domain or outbound connection for defenders to block. A later variant also pulls environment-scoped secrets, often production credentials. In enterprise organizations, Wiz saw the tool cycle through tokens of several users and automation accounts within minutes, clone private repositories before planting the workflow, and, hours later, cloud credentials from the same organization used to enumerate AWS Secrets Manager.
Public repositories were saved by an approval hold
Since July 28, 2026, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them. Every public Gheist run Wiz checked sat at "action required", so the payload never executed there. That hold does not apply to private repositories or GitHub Enterprise Server, and Wiz found audit logs there showing runs on ci-sync branches completing and then being deleted by the gheist user agent.
On October 19 one variant added a second job aimed at self-hosted runners. It sweeps the host for 31 token formats (including AI provider keys), private keys, .env files and Terraform state, and uses the Docker socket to search the host itself, though Wiz notes the job is buggy.
One pool of stolen access, many operators
The same accounts are being used by other campaigns, including cracked-software lure repositories and cryptomining on free Actions compute. Some victims also appear infected with PolinRider, which Wiz describes as DPRK-linked malware that hides JavaScript in build config files. The credential sources Wiz could trace fit infostealer logs and tokens exposed in earlier supply-chain compromises, the same pattern behind an earlier mass repo-cloning campaign and Wiz's finding that cloud keys top what infostealers steal. Wiz stresses Gheist is distinct from the GhostAction campaign, which exfiltrates secrets to 193[.]32[.]204[.]199.
Rotate every exposed secret, not just the branch
Hunt for ci-sync- branches whose only change adds sync-check.yml, workflow runs on ci-sync-* branches deleted within a minute of completing, and any activity from the gheist user agent. If workflows use OIDC to reach the cloud, check cloud audit logs for role assumptions whose subject includes a ci-sync- branch; that proves Actions ran on an attacker branch even without GitHub logs. On self-hosted runners, look for the files .gdmp_pat, .gdmp_patg and .gdmp_sweep and the string "gdmp-pivot" in job logs.
Deleting the run or the branch does not undo the exposure. Rotate every repository, organization and environment secret available to an affected repository, revoke the tokens that pushed the commits, and check their owners' devices for infostealers. Treat any self-hosted runner that executed a ci-sync job, and its instance role, as compromised. Longer term, Wiz recommends required reviewers on production environments, OIDC trust scoped to protected branches, and short-lived tokens instead of personal access tokens.
Indicators
- User agent: gheist
- Branch pattern: ^ci-sync-[0-9a-z]{6}$, commit message "ci: sync config"
- Workflow blob SHA-1s: f3da2b8b357dcda02fd455d314be2a95007516a6, d09535857a741bbb976bdc084a9a021713133291, 1dc5af9cce950aad1eb1546ecce8565b117540c4, c665b778b2d822453293003e7ca0bbb2cb08e39d
The lesson of Gheist is that a stolen token is not one breach but a key ring: whoever holds it can turn a platform's own automation into the exfiltration channel, and only controls that sit inside that platform will see it happen.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.