[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBBadXrcTNYS7qHLPN3y4s8Tbhw-aCuXxh-Z_VwnUI7U":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"a46778e6-0336-4b5e-83d7-c84726595286","stolen-github-tokens-expose-private-repo-secrets-in-gheist-campaign","01b8714f-534a-41ff-ab1c-6533bc148a1f","Stolen GitHub Tokens Expose Private Repo Secrets in Gheist Campaign","The Gheist campaign demonstrates how stolen access tokens can be weaponized to silently exfiltrate secrets from private repositories, bypassing GitHub's built-in secret masking through encoding tricks. Over 850 accounts were compromised, with malicious workflows injected and then deleted to cover the attacker's tracks, making detection extremely difficult. The core failure lies in over-privileged, long-lived tokens and insufficient controls around CI\u002FCD workflow integrity. This matters because production-grade credentials harvested this way can enable cascading breaches across cloud environments, pipelines, and third-party services.","**Immediate actions:**\n- Audit and revoke all existing GitHub personal access tokens and OAuth tokens, replacing them with short-lived, scoped tokens or GitHub Apps with minimal permissions.\n- Scan all repositories and CI\u002FCD workflow files for unauthorized changes or newly injected steps that could exfiltrate environment variables.\n- Enable GitHub's secret scanning alerts and push protection to detect exposed credentials in real time.\n\n**Long-term improvements:**\n- Enforce least-privilege token policies by scoping all GitHub tokens to the minimum required permissions and setting mandatory expiration dates.\n- Implement branch protection rules and required code reviews for workflow files (`.github\u002Fworkflows\u002F`) to prevent unauthorized injection of malicious CI\u002FCD steps.\n- Rotate all environment-scoped credentials (API keys, cloud credentials, database passwords) that may have been exposed in affected repositories.\n\n**Detection measures:**\n- Enable comprehensive audit logging for GitHub Actions workflow runs, token usage, and branch creation\u002Fdeletion events, and forward logs to a SIEM for anomaly detection.\n- Set up alerts for unusual branch creation patterns (e.g., mass branch creation by a single actor) and unexpected workflow file modifications.\n- Integrate a secrets management vault (e.g., HashiCorp Vault, AWS Secrets Manager) to replace hardcoded secrets in CI\u002FCD pipelines with dynamically fetched, short-lived credentials.",[12,13,14,15,16,17,18],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1528: Steal Application Access Token","CIS Control 8: Audit Log Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"CIS Control 5: Account Management":21,"CIS Control 8: Audit Log Management":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"MITRE ATT&CK T1528: Steal Application Access Token":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement controls around access management and incident handling for supply chain and CI\u002FCD environments, directly applicable to preventing and detecting stolen token abuse in software development pipelines.","The campaign relied on stolen, long-lived GitHub tokens with broad permissions; enforcing least-privilege access and mandatory token expiration would have limited the blast radius of any single compromised token.","The campaign deleted branches and workflows to erase evidence; robust, tamper-resistant audit logging of GitHub Actions runs and repository events would have preserved forensic data and enabled earlier detection.","Regularly auditing CI\u002FCD pipeline configurations and workflow files for unauthorized changes is analogous to flaw remediation — catching malicious injections before they execute and exfiltrate secrets.","Gheist directly exploits stolen GitHub access tokens to authenticate to private repositories, matching this technique's definition of abusing stolen OAuth or API tokens to gain unauthorized access.","Organizations should maintain awareness of misconfigurations and insecure practices in their software supply chain tooling, including over-privileged tokens in GitHub, as technical vulnerabilities requiring remediation.","Proper identity and access controls — including short-lived, scoped credentials and multi-factor authentication for repository access — would have reduced attackers' ability to authenticate using stolen tokens.","published","2026-10-27T12:23:32.21669+00:00","2026-10-27T12:23:32.194+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Fgheist-github-token-abuse\u002F","private-repos-still-leak-secrets-to-gheist-a-stolen-github-token-campaign-6e708b","Private repos still leak secrets to Gheist, a stolen GitHub token campaign",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]