Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo
GitHub repositories / GitHub Actions (compromised tokens)
Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction.
Why this severity: Ongoing mass CI/CD secret theft; confirmed successful runs and follow-on cloud activity in private and enterprise repos
- Started
- Sep 15, 2026
Affected
- GitHub repositories reachable by a stolen token where a ci-sync-<6 chars> branch added .github/workflows/sync-check.yml ('ci: sync config'); private repos and GitHub Enterprise Server are not covered by GitHub's public-repo approval hold
Fixed in
No fixed release yet
Timeline4
Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration.
Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy).
Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too.
Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run.
News & write-ups1
Notes & caveats
Wiz explicitly says Gheist is distinct from GhostAction (different workflow files; GhostAction exfiltrates to 193.32.204.199). Wiz saw the same compromised accounts used by other campaigns (cracked-software lure repos, cryptomining runners, PolinRider, Megalodon) and traced credentials to infostealer logs and earlier supply-chain compromises such as the March Trivy compromise. patchStatus partial: GitHub holds suspicious runs in public repos since Jul 28 2026, but private repos and GHES are unprotected and stolen secrets stay valid until rotated.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
