[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ_76Mdq3jjxjCd4TvhsYU0Mo-Ft08jgPwcgH50OspMg":3},{"article":4,"iocs":51,"watch_terms":54,"solutions":55,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"197d6d13-8e22-4ddd-a7ff-0ec143f499c1","Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs","gheist-uses-stolen-github-tokens-to-steal-private-repository-secrets-via-actions-a26d3a","An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses","An automated campaign dubbed 'Gheist' is exploiting stolen GitHub tokens to access private repositories. Attackers plant malicious workflows that exfiltrate sensitive secrets by printing them into GitHub Actions logs. These logs are then downloaded by the attackers before the workflow runs are deleted, making detection more difficult.","Gheist campaign steals GitHub repo secrets using stolen tokens and Actions logs.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fgheist-uses-stolen-github-tokens-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEipCbP2hnS9ddXqMz9cNIAMEQZWy2qX45MZnYfIuO_Zszamhl_FS7ViRp4CZcjHS6uu6A4jR_S4vBzHzoMNtAb0CbaGxHxj2F07wuKWHfSbsFUov-4dsQWUNJZwfGbnfThW1sAQZ61y5ibqyhlW1iBmbWeSwE1gKHsigRRXaql9P96aFANb3al6vno7fuA\u002Fs1600\u002Fgithub-secrets.jpg","2026-10-26T07:49:46+00:00","2026-10-26T10:00:22.184119+00:00",8,[17,20,23,26],{"name":18,"type":19},"Gheist","threat_actor",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":25},"GitHub Actions","product",{"name":27,"type":22},"Wiz","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":32,"value":18,"context":53},"Name of the automated campaign",[21,27,24],{"controls":56,"vendors":141},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":87,"name":88,"problem":89,"products":90},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,125,133],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":121,"product_name":122,"url":123,"description":124},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[142,147],{"slug":143,"name":21,"logo_path":144,"roles":145},"github","\u002Fvendor-logos\u002Fgithub.png",[146],"affected",{"slug":148,"name":27,"logo_path":149,"roles":150},"wiz","\u002Fvendor-logos\u002Fwiz.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"stolen-github-tokens-enable-secret-exfiltration-via-actions-logs","Stolen GitHub Tokens Enable Secret Exfiltration via Actions Logs","The Gheist campaign exploits stolen GitHub personal access tokens to gain unauthorized access to private repositories and inject malicious workflow files. By printing secrets into GitHub Actions logs — a feature intended for debugging — attackers abuse a legitimate mechanism to exfiltrate sensitive credentials and tokens. Deleting workflow runs after the fact erases forensic evidence, compounding the damage by delaying detection and response. This incident highlights that overprivileged tokens, poorly scoped secrets, and insufficient log retention create a compounding failure that attackers can exploit silently. Protecting CI\u002FCD pipelines requires the same rigor as production systems.",[157,158,159,160,161,162,163],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1552: Unsecured Credentials","CIS Control 8: Audit Log Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":165,"CIS Control 5: Account Management":166,"CIS Control 8: Audit Log Management":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"MITRE ATT&CK T1552: Unsecured Credentials":169,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"NIS2 requires organizations to implement controls on access and supply chain security; inadequate token governance and CI\u002FCD pipeline oversight directly violates these incident-handling and access management obligations.","Stolen tokens with excessive privileges were the attack's entry point; enforcing least-privilege scopes and token lifecycle management would have limited what attackers could access.","Attackers deleted workflow run logs to hinder detection; mandating immutable, centralized audit log retention would have preserved forensic evidence and enabled faster incident response.","Regularly reviewing and hardening CI\u002FCD pipeline configurations — including workflow permissions and secret exposure paths — falls under flaw and misconfiguration remediation.","Attackers specifically targeted secrets exposed in GitHub Actions logs, which is a direct instance of harvesting unsecured credentials from development pipeline artifacts.","Misconfigured GitHub Actions workflows that allow secrets to be printed to logs represent a technical vulnerability that should be identified and remediated through systematic controls.","The framework requires that access credentials be tightly scoped and monitored; properly managed, short-lived tokens would have prevented unauthorized repository access."]