--- title: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets description: A campaign called 'Gheist' is abusing stolen GitHub tokens to harvest cloud secrets from developer repositories. Wiz Research found over 13,500 malicious... canonical: https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets | daily.dev og:description: A campaign called 'Gheist' is abusing stolen GitHub tokens to harvest cloud secrets from developer repositories. Wiz Research found over 13,500 malicious... og:url: https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu og:image: https://api.daily.dev/og/posts/PHyis9kdu.png og:image:alt: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A campaign called 'Gheist' is abusing stolen GitHub tokens to harvest cloud secrets from developer repositories. Wiz Research found over 13,500 malicious branches across more than 850 compromised GitHub accounts. Attackers push a workflow named 'sync-check' via branches named 'ci-sync-' plus six characters, printing secrets into the workflow log, downloading it through the GitHub API, then deleting the run within seconds. Output is Base32-encoded, and since secrets exit through GitHub's own API there's no outbound connection to block. Private repositories bypass GitHub's July public-repo safeguards, and attackers used stolen credentials to enumerate AWS Secrets Manager at affected organizations. Wiz estimates the campaign affected on the scale of a dozen companies and says the operation remains active as of October 24, after it began tracking the activity on September 15. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Gheist attack steal secrets from GitHub repositories without triggering network alerts? It pushes a GitHub Actions workflow named 'sync-check' to a branch named 'ci-sync-' plus six characters, which prints environment variables and repository secrets into its own workflow log, Base32-encodes the output, downloads the log via the GitHub API, then deletes the workflow run within seconds. Because the data exits through GitHub's own API, there is no attacker domain or outbound connection for network monitoring to block. _Teams hardening CI/CD pipelines against token abuse can track emerging attack techniques like this on daily.dev._ ### What should I look for in GitHub audit logs to detect the Gheist token theft campaign? Check for branches named 'ci-sync-' followed by six characters containing only a new .github/workflows/sync-check.yml file with the commit message 'ci: sync config,' workflow runs on those branches that were deleted within a minute of completion, and any activity from the user agent 'gheist.' Wiz Research identified over 13,500 such malicious branches across more than 850 compromised accounts. _Security engineers building detection rules for supply chain attacks can follow coverage like this on daily.dev._ ### Does GitHub's public repository workflow abuse protection stop attacks on private enterprise repositories? No, the safeguard GitHub introduced in July only protects public repositories from workflow abuse vectors; it does not apply once an enterprise credential is compromised. Wiz Research observed successful Gheist attacks against private repositories and enterprise environments, with cloud credentials later used to enumerate AWS Secrets Manager within hours of compromise. _Developers deciding how to scope GitHub token permissions can stay current on these risks via daily.dev._ ## Similar posts on daily.dev - [GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) · StepSecurity · 0 upvotes · 0 comments - [A Mini Shai-Hulud Targeting the SAP Ecosystem](https://daily.dev/posts/a-mini-shai-hulud-targeting-the-sap-ecosystem-6uhenjkh7) · Security Boulevard · 0 upvotes · 0 comments - [Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks](https://daily.dev/posts/four-credential-harvesting-campaigns-hit-open-source-ecosystems-in-two-weeks-gtsbqgosw) · GitGuardian · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#github](https://daily.dev/tags/github), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets","url":"https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu"},"datePublished":"2026-10-26T18:19:15.386Z","dateModified":"2026-10-28T15:02:06.955Z","description":"A campaign called 'Gheist' is abusing stolen GitHub tokens to harvest cloud secrets from developer repositories. Wiz Research found over 13,500 malicious...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/964ee419e5e677d137bc4793f4960d86?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/964ee419e5e677d137bc4793f4960d86?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,aws,github,github-actions","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gheist-weaponizes-github-tokens-to-steal-cloud-secrets-phyis9kdu#faq","mainEntity":[{"@type":"Question","name":"How does the Gheist attack steal secrets from GitHub repositories without triggering network alerts?","acceptedAnswer":{"@type":"Answer","text":"It pushes a GitHub Actions workflow named 'sync-check' to a branch named 'ci-sync-' plus six characters, which prints environment variables and repository secrets into its own workflow log, Base32-encodes the output, downloads the log via the GitHub API, then deletes the workflow run within seconds. Because the data exits through GitHub's own API, there is no attacker domain or outbound connection for network monitoring to block. Teams hardening CI/CD pipelines against token abuse can track emerging attack techniques like this on daily.dev."}},{"@type":"Question","name":"What should I look for in GitHub audit logs to detect the Gheist token theft campaign?","acceptedAnswer":{"@type":"Answer","text":"Check for branches named 'ci-sync-' followed by six characters containing only a new .github/workflows/sync-check.yml file with the commit message 'ci: sync config,' workflow runs on those branches that were deleted within a minute of completion, and any activity from the user agent 'gheist.' Wiz Research identified over 13,500 such malicious branches across more than 850 compromised accounts. Security engineers building detection rules for supply chain attacks can follow coverage like this on daily.dev."}},{"@type":"Question","name":"Does GitHub's public repository workflow abuse protection stop attacks on private enterprise repositories?","acceptedAnswer":{"@type":"Answer","text":"No, the safeguard GitHub introduced in July only protects public repositories from workflow abuse vectors; it does not apply once an enterprise credential is compromised. Wiz Research observed successful Gheist attacks against private repositories and enterprise environments, with cloud credentials later used to enumerate AWS Secrets Manager within hours of compromise. Developers deciding how to scope GitHub token permissions can stay current on these risks via daily.dev."}}]} ```