# Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo · pwn.watch > Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction. Page: https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows · generated 2026-10-25T19:12:56.506Z ## Status - Severity: high · status: live · patch: partial - Product: GitHub repositories / GitHub Actions (compromised tokens) - Started: 2026-09-15 - Affected: GitHub repositories reachable by a stolen token where a ci-sync-<6 chars> branch added .github/workflows/sync-check.yml ('ci: sync config'); private repos and GitHub Enterprise Server are not covered by GitHub's public-repo approval hold ## Follow this incident - RSS (one item per update): https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/feed.xml - JSON Feed: https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows.json - This file: https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows/llms.txt ## Updates (newest first) - 2026-10-24: Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration. (https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) - 2026-10-19: Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy). (https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) - 2026-09-28: Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too. (https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) - 2026-09-15: Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run. (https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) ## Fix brief # Security brief: Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo Source: https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows · status: live · severity: high · updated Oct 25, 2026, 18:58 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction. Severity detail: Ongoing mass CI/CD secret theft; confirmed successful runs and follow-on cloud activity in private and enterprise repos - Product: GitHub repositories / GitHub Actions (compromised tokens) ## Affected versions - GitHub repositories reachable by a stolen token where a ci-sync-<6 chars> branch added .github/workflows/sync-check.yml ('ci: sync config'); private repos and GitHub Enterprise Server are not covered by GitHub's public-repo approval hold ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Hunt for branches matching ^ci-sync-[0-9a-z]{6}$ that only add .github/workflows/sync-check.yml with message 'ci: sync config'; audit-log runs on ci-sync-* deleted within a minute of finishing, and the user agent 'gheist'; cloud OIDC role assumptions whose subject contains ci-sync-; on self-hosted runners the files .gdmp_pat, .gdmp_patg, .gdmp_sweep and 'gdmp-pivot' in logs. If hit: rotate every repo, org and environment secret the repo could see, revoke the pushing tokens and check owners for infostealers, treat any self-hosted runner that ran it as compromised, and never approve held sync-check runs. ## Latest updates - Oct 24, 2026: Wiz: 13,500+ planted branches recovered from 850+ compromised accounts; attack ongoing and evolving. GitHub's approval hold blocks it in public repos, but runs completed in private repos and GitHub Enterprise Server, followed by AWS Secrets Manager enumeration. - Oct 19, 2026: Tool B adds a 'sync-host' job for repos with self-hosted runners: sweeps the host for 31 token formats, process environments, the Docker host filesystem, cloud metadata and Kubernetes tokens (Wiz notes the job is buggy). - Sep 28, 2026: Second variant (Tool B) appears and within hours adds a 6-minute timeout and a deployment-environment matrix, so environment-scoped (often production) secrets are dumped too. - Sep 15, 2026: Wiz Research starts tracking Gheist: stolen GitHub tokens commit a 'sync-check' workflow on ci-sync-* branches that dumps repo secrets base32-encoded into the run log, then the tool downloads the log and deletes the run. ## Write-ups & news - [Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) ## Caveats Wiz explicitly says Gheist is distinct from GhostAction (different workflow files; GhostAction exfiltrates to 193.32.204.199). Wiz saw the same compromised accounts used by other campaigns (cracked-software lure repos, cryptomining runners, PolinRider, Megalodon) and traced credentials to infostealer logs and earlier supply-chain compromises such as the March Trivy compromise. patchStatus partial: GitHub holds suspicious runs in public repos since Jul 28 2026, but private repos and GHES are unprotected and stolen secrets stay valid until rotated. --- Machine-readable: https://pwn.watch/i/gheist-stolen-github-tokens-secret-dump-workflows.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.