{ "version": "https://jsonfeed.org/version/1.1", "title": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo ยท updates", "home_page_url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows", "feed_url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/feed.json", "description": "Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction.", "language": "en", "_pwn": { "slug": "gheist-stolen-github-tokens-secret-dump-workflows", "severity": "high", "status": "live", "patchStatus": "partial", "rss": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/feed.xml", "llms": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/llms.txt", "json": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows.json" }, "items": [ { "id": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-10-24-d6bb2e23", "url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-10-24-d6bb2e23", "title": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration.", "content_text": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration.\n\nSource: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "date_published": "2026-10-24T00:00:00.000Z", "external_url": "https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "tags": [ "high" ] }, { "id": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-10-19-b9aede23", "url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-10-19-b9aede23", "title": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy).", "content_text": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy).\n\nSource: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "date_published": "2026-10-19T00:00:00.000Z", "external_url": "https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "tags": [ "high" ] }, { "id": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-09-28-b9c2a1be", "url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-09-28-b9c2a1be", "title": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too.", "content_text": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too.\n\nSource: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "date_published": "2026-09-28T00:00:00.000Z", "external_url": "https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "tags": [ "high" ] }, { "id": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-09-15-30da97a1", "url": "https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows#2026-09-15-30da97a1", "title": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run.", "content_text": "Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run.\n\nSource: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "date_published": "2026-09-15T00:00:00.000Z", "external_url": "https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles", "tags": [ "high" ] } ] }