Gheist

Gheist is an automated credential-stealing campaign and associated toolset targeting GitHub repositories through malicious GitHub Actions workflows. Active since September 15, 2026, it abuses stolen GitHub tokens with repository write access to create branches and commit workflows that expose repository secrets. Observed activity involved more than 13,500 malicious branches across more than 850 compromised accounts, including personal projects and private enterprise repositories; these figures do not establish how many organizations suffered secret exposure.

The workflows encode accessible secrets in base32 to bypass GitHub's secret-masking mechanisms. Attackers retrieve the resulting logs through the GitHub API and delete workflow runs within seconds, using GitHub itself as the exfiltration channel. Variants enumerate deployment environments and create jobs to obtain environment-scoped secrets. Successful execution has been confirmed in private repositories and GitHub Enterprise Server environments. All examined public-repository runs remained pending approval under GitHub's suspicious-workflow controls.

A later variant attempts to collect credentials from self-hosted runners, including private keys, application tokens, process environments, cloud instance credentials, and Kubernetes service-account tokens. Its collection logic includes accessing the host filesystem through Docker. This runner-targeting component was buggy, and successful execution was not confirmed.

Some tokens used by Gheist originated in infostealer logs and earlier software supply-chain compromises. Victim overlap with PolinRider, Megalodon, and separate malware-distribution activity does not establish shared operators or attribution. No specific threat actor or industry focus has been established.