Sep 15, 2026

Started

• LiveHigh◐Partly patched

  Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo

  Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction.

  GitHub repositories / GitHub Actions (compromised tokens)·Since Sep 15, 2026·updated Oct 25, 2026, 18:58 UTC