Wiz Research published the Gheist write-up today (Oct 25), and the numbers are the kind that make you open a terminal: since September 15, someone has been using stolen GitHub tokens to plant a secret-dumping workflow into every repository each token can reach. Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts , enterprise private repos included. The campaign is still running.

The mechanics are almost insultingly simple, which is why I wanted to verify them myself:

Create a branch matching ^ci-sync-[0-9a-z]{6}$ , commit one file — .github/workflows/sync-check.yml , message ci: sync config .

The workflow runs on push and prints toJSON(secrets) — every secret the repo can access — piped through base32 .

Download the run log through the GitHub API, delete the run seconds later.…