Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Gheist campaign steals GitHub repo secrets using stolen tokens and Actions logs.
An automated campaign dubbed 'Gheist' is exploiting stolen GitHub tokens to access private repositories. Attackers plant malicious workflows that exfiltrate sensitive secrets by printing them into GitHub Actions logs. These logs are then downloaded by the attackers before the workflow runs are deleted, making detection more difficult.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Gheist campaign exploits stolen GitHub personal access tokens to gain unauthorized access to private repositories and inject malicious workflow files. By printing secrets into GitHub Actions logs — a feature intended for debugging — attackers abuse a legitimate mechanism to exfiltrate sensitive credentials and tokens. Deleting workflow runs after the fact erases forensic evidence, compounding the damage by delaying detection and response. This incident highlights that overprivileged tokens, poorly scoped secrets, and insufficient log retention create a compounding failure that attackers can exploit silently. Protecting CI/CD pipelines requires the same rigor as production systems.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gheist