Gheist Abuses Stolen GitHub Tokens to Steal Actions Secrets and Target Runners

The Gheist campaign is using stolen GitHub tokens to plant malicious GitHub Actions workflows and steal repository, organization, and environment secrets. Wiz Research has tracked the activity since September 15, 2026, identifying more than 13,500 planted branches across over 850 compromised accounts. The workflows base32-encode secrets to evade log masking, retrieve execution logs through GitHub’s API, and rapidly delete the runs. GitHub’s approval controls blocked every public-repository run Wiz examined, but successful executions were observed in private repositories and enterprise environments, including GitHub Enterprise Server.

An evolving variant targets self-hosted runners, collecting application tokens, accessing host files through Docker, and harvesting cloud and orchestration credentials. Cloud credentials associated with affected organizations were subsequently used to enumerate AWS Secrets Manager, demonstrating risk beyond source-code repositories. Defenders should revoke compromised GitHub tokens, rotate exposed secrets, and treat affected runner hosts as compromised, while investigating workflow changes and downstream cloud activity. Reported overlaps with malware distribution and cryptomining do not establish common attribution.