Gheist attackers exploit GitHub Actions logs to collect repository secrets
The campaign uses stolen GitHub tokens to insert workflows that expose repository secrets in Actions logs. Attackers download those logs and delete the runs, according to The Hacker News, which cites Wiz's finding that attacks succeeded in private repositories and GitHub Enterprise environments. RuntimeWire reports that GitHub's approval hold stopped observed public-repository runs but not private ones.
- RuntimeWire reports Wiz recovered over 13,500 planted branches across more than 850 compromised accounts.
Covered by 3 publishers within 21 hours of the first report.
Reporting3
RuntimeWire Wiz says stolen GitHub tokens let attackers dump secrets through Actions logs · RuntimeWire Staff
The Hacker News Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs · info@thehackernews.com (The Hacker News)
Dark Reading 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets · Elizabeth Montalbano