[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:gheist-campaign-abuses-stolen-github-tokens-to-dump-private":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","rapid-alert","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","Marcus Lenngren","2026-10-27T05:06:27.466+00:00","![Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nSince 15 September 2026, Wiz Research has tracked a campaign it calls Gheist that abuses compromised GitHub tokens at scale. For each repository a token can reach, the tool creates a branch named ci-sync- followed by six random characters, then commits a file at .github\u002Fworkflows\u002Fsync-check.yml with the commit message ci: sync config. The push triggers the workflow, which prints the repository's secrets into its own log in base32 so GitHub's masking does not catch them. The tool then downloads the log through the GitHub API and deletes the run seconds later. Its API requests carry the user agent gheist.\n\nWiz has recovered more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to enterprise private repositories. The credentials appear to come from infostealer logs and earlier supply-chain compromises.\n\n## Timeline\n\n- 28 Jul 2026: GitHub begins holding potentially malicious workflow runs in public repositories until a collaborator approves them.\n- 15 Sep 2026: Gheist campaign begins.\n- 28 Sep 2026: Tool B adds timeout-minutes: 6 and an environment matrix to reach environment-scoped secrets.\n- 19 Oct 2026: Tool B adds a base32 separator and a sync-host job targeting self-hosted runners.\n- 24 Oct 2026: Attack ongoing and evolving. Roughly two thirds of implicated accounts are no longer on GitHub.\n\n## Am I affected?\n\nPublic repositories are largely protected: every public Gheist run Wiz checked sits at action_required, so the payload never ran. The hold does not apply to private repositories or to GitHub Enterprise Server. There, audit logs show runs on ci-sync-* branches completing and then being deleted by the gheist user agent.\n\nYou are exposed if a token with access to your private repos or GHES was stolen, and more so if your repos hold deployment environments with production credentials, or register self-hosted runners.\n\n## What to do now\n\n1. Search every repository and GHES organisation for branches named ci-sync- plus six random characters whose only change is a new .github\u002Fworkflows\u002Fsync-check.yml with the message ci: sync config. Delete them.\n2. Treat any secret in an affected repository as compromised. Rotate repository secrets, environment-scoped secrets, OIDC-linked cloud roles and automation account tokens.\n3. Review GitHub tokens and personal access tokens for the affected accounts. Revoke and reissue them.\n4. If a repository had deployment environments, rotate the production credentials first, since the environment matrix is designed to reach them.\n5. For self-hosted runners, assume host compromise. Rotate cloud instance-role credentials, Kubernetes service account tokens, and anything reachable through the Docker socket, then rebuild the runner.\n6. Check AWS Secrets Manager and similar stores for enumeration, since Wiz saw stolen cloud credentials used to list secrets hours after the initial dump.\n\n## How to hunt\n\nIn GitHub audit logs, look for workflow runs on ci-sync-* branches deleted within a minute of completing, and for any activity from the user agent gheist.\n\nIf your workflows use OIDC to authenticate to the cloud, check cloud audit logs for role assumptions or token exchanges whose subject includes a ci-sync- branch. That proves Actions ran on an attacker branch even if you do not collect GitHub logs. In AWS, CloudTrail shows your own workflows assuming roles on those branches.\n\nOn self-hosted runners, look for the sync-host job, for the helper files .gdmp_pat, .gdmp_patg and .gdmp_sweep, and for log headers of the form ===== gdmp-pivot: \u003Cstage> =====.\n\n## What does not help\n\nSetting permissions: {} on the job does not stop this. It restricts the job's GITHUB_TOKEN, which the attacker does not need, but it does not restrict the secrets context that the payload reads.\n\nBlocking an attacker domain does not help either. The secrets leave through GitHub's own API, so there is no outbound connection or attacker domain to block. Note that Gheist is distinct from GhostAction, which exfiltrates to 193.32.204[.]199.\n\n## Sources\n\n- [Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles](https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fgheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles), Wiz Research, 25 Oct\n- ['Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fgheist-stolen-github-tokens-cloud-secrets), Dark Reading, 26 Oct\n- [Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fgheist-uses-stolen-github-tokens-to.html), The Hacker News, 26 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,38,45],{"slug":30,"kind":31,"title":32,"excerpt":33,"cover_image_url":34,"cover_image_alt":35,"author_name":11,"published_at":36,"reading_minutes":37},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":39,"kind":6,"title":40,"excerpt":41,"cover_image_url":42,"cover_image_alt":43,"author_name":11,"published_at":44,"reading_minutes":18},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00",{"slug":46,"kind":6,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":18},"arista-patches-third-exploited-velocloud-orchestrator-zero","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","2026-10-23T15:26:13.908+00:00"]