[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f31L4PSw-eL5Ij_gJHduPgKji96P2UzVGz6zE4ELZe9M":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"7f572300-4b4c-42ee-9948-16e9da0e6857","stolen-github-tokens-enable-secret-exfiltration-via-actions-logs","197d6d13-8e22-4ddd-a7ff-0ec143f499c1","Stolen GitHub Tokens Enable Secret Exfiltration via Actions Logs","The Gheist campaign exploits stolen GitHub personal access tokens to gain unauthorized access to private repositories and inject malicious workflow files. By printing secrets into GitHub Actions logs — a feature intended for debugging — attackers abuse a legitimate mechanism to exfiltrate sensitive credentials and tokens. Deleting workflow runs after the fact erases forensic evidence, compounding the damage by delaying detection and response. This incident highlights that overprivileged tokens, poorly scoped secrets, and insufficient log retention create a compounding failure that attackers can exploit silently. Protecting CI\u002FCD pipelines requires the same rigor as production systems.","**Immediate actions:**\n- Audit and rotate all GitHub personal access tokens immediately, enforcing short expiration windows and least-privilege scopes.\n- Review GitHub Actions workflow files in all private repositories for unauthorized or recently added entries.\n- Enable GitHub's secret scanning and push protection to block accidental or malicious secret exposure in logs.\n\n**Long-term improvements:**\n- Enforce branch protection rules and require code review approvals before any workflow file changes are merged.\n- Replace long-lived personal access tokens with short-lived, scoped GitHub Apps credentials or OIDC-based authentication.\n- Ensure CI\u002FCD secrets are stored in a dedicated secrets manager (e.g., HashiCorp Vault) and never echoed or printed into log output.\n\n**Detection measures:**\n- Enable audit log streaming for GitHub organizations and alert on anomalous token usage, workflow creation, or bulk log deletions.\n- Implement SIEM rules to detect rapid workflow-run deletions, which are a key indicator of post-exfiltration cover-up.\n- Periodically review which identities have repository write access and remove stale or overprivileged accounts.",[12,13,14,15,16,17,18],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1552: Unsecured Credentials","CIS Control 8: Audit Log Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"CIS Control 5: Account Management":21,"CIS Control 8: Audit Log Management":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"MITRE ATT&CK T1552: Unsecured Credentials":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires organizations to implement controls on access and supply chain security; inadequate token governance and CI\u002FCD pipeline oversight directly violates these incident-handling and access management obligations.","Stolen tokens with excessive privileges were the attack's entry point; enforcing least-privilege scopes and token lifecycle management would have limited what attackers could access.","Attackers deleted workflow run logs to hinder detection; mandating immutable, centralized audit log retention would have preserved forensic evidence and enabled faster incident response.","Regularly reviewing and hardening CI\u002FCD pipeline configurations — including workflow permissions and secret exposure paths — falls under flaw and misconfiguration remediation.","Attackers specifically targeted secrets exposed in GitHub Actions logs, which is a direct instance of harvesting unsecured credentials from development pipeline artifacts.","Misconfigured GitHub Actions workflows that allow secrets to be printed to logs represent a technical vulnerability that should be identified and remediated through systematic controls.","The framework requires that access credentials be tightly scoped and monitored; properly managed, short-lived tokens would have prevented unauthorized repository access.","published","2026-10-26T10:21:50.115021+00:00","2026-10-26T10:21:50.084+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fgheist-uses-stolen-github-tokens-to.html","gheist-uses-stolen-github-tokens-to-steal-private-repository-secrets-via-actions-a26d3a","Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]