Gheist

Gheist is a campaign active since September 15, 2026, that abuses stolen GitHub tokens to extract repository secrets through malicious GitHub Actions workflows. Its operators have planted more than 13,500 branches across over 850 compromised accounts, affecting personal projects and private enterprise repositories. The operators' identities, geographic origin, and dominant motivation are not established. The campaign creates repository branches and commits malicious workflows that encode secrets in base32 to bypass GitHub's native secret masking. It retrieves the resulting workflow logs through the GitHub API and rapidly deletes workflow executions to conceal activity. This exfiltration mechanism uses GitHub infrastructure rather than a separate command-and-control endpoint. Two tooling variants, designated Tool A and Tool B, differ in branch-generation patterns and workflow complexity. Since October 19, 2026, Tool B has additionally targeted self-hosted runners. Its payload searches for application tokens, accesses the host filesystem through the Docker socket, retrieves AWS, Google Cloud, and Microsoft Azure credentials through metadata services, and steals Kubernetes and GitLab runner tokens. In observed enterprise environments, cloud credentials associated with the affected organizations were subsequently used to enumerate AWS Secrets Manager. GitHub's suspicious-workflow controls have interrupted activity in public repositories, while complete malicious workflow executions have occurred in private repositories and GitHub Enterprise Server. Overlaps with other malicious activity do not establish shared operators or nation-state attribution.