Stolen GitHub Tokens Enable Secret Exfiltration via Actions Logs
Written by AI from the linked story. Not reviewed by an editor. How this works
The Gheist campaign exploits stolen GitHub personal access tokens to gain unauthorized access to private repositories and inject malicious workflow files. By printing secrets into GitHub Actions logs — a feature intended for debugging — attackers abuse a legitimate mechanism to exfiltrate sensitive credentials and tokens. Deleting workflow runs after the fact erases forensic evidence, compounding the damage by delaying detection and response. This incident highlights that overprivileged tokens, poorly scoped secrets, and insufficient log retention create a compounding failure that attackers can exploit silently. Protecting CI/CD pipelines requires the same rigor as production systems.
Tactical Insight
Immediate actions
- Audit and rotate all GitHub personal access tokens immediately, enforcing short expiration windows and least-privilege scopes.
- Review GitHub Actions workflow files in all private repositories for unauthorized or recently added entries.
- Enable GitHub's secret scanning and push protection to block accidental or malicious secret exposure in logs.
Long-term improvements
- Enforce branch protection rules and require code review approvals before any workflow file changes are merged.
- Replace long-lived personal access tokens with short-lived, scoped GitHub Apps credentials or OIDC-based authentication.
- Ensure CI/CD secrets are stored in a dedicated secrets manager (e.g., HashiCorp Vault) and never echoed or printed into log output.
Detection measures
- Enable audit log streaming for GitHub organizations and alert on anomalous token usage, workflow creation, or bulk log deletions.
- Implement SIEM rules to detect rapid workflow-run deletions, which are a key indicator of post-exfiltration cover-up.
- Periodically review which identities have repository write access and remove stale or overprivileged accounts.