Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo · updates

Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration.

Sat, 24 Oct 2026 00:00:00 GMT

Source

Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy).

Mon, 19 Oct 2026 00:00:00 GMT

Source

Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too.

Mon, 28 Sep 2026 00:00:00 GMT

Source

Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo: Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run.

Tue, 15 Sep 2026 00:00:00 GMT

Source