An automated campaign named Gheist uses stolen GitHub tokens to inject workflows into repositories, printing secrets into Actions logs for exfiltration.

Wiz tracked over 13,500 planted branches across 850+ compromised accounts affecting private and enterprise environments.

How the attack works

The attackers use stolen access keys to automatically create new working branches in repositories. Each new branch starts with the name ci-sync- followed by six random characters.

They then add a file that instructs the system to print all the passwords and secrets stored in the repository to the log files. This data is encrypted to bypass the platform's automatic protection measures.

As soon as the process is complete, the perpetrators' tool downloads the files with sensitive data and deletes traces of execution within a few seconds.

The extent of the problem

Wiz’s research has shown that more than 13.500 compromised forks have been identified so far across over 850 accounts.…