Gheist Campaign Exploits GitHub Tokens to Harvest Cloud Secrets

An ongoing supply chain campaign dubbed Gheist is actively abusing GitHub authentication tokens to exfiltrate cloud credentials and sensitive operational data from thousands of software repositories.

The threat actors behind the operation leverage compromised personal access tokens and OAuth credentials to systematically scan public and private repositories for exposed environment variables, cloud access keys, and infrastructure tokens.

Once obtained, the compromised tokens provide programmatic access to target codebases where developers may have committed hardcoded secrets, including cloud provider access keys, database connection strings, and internal API credentials.

Automated Secret Exfiltration Across Repositories

The Gheist campaign operates by automating repository enumeration following the initial compromise of a developer account. Because developer access tokens frequently inherit wide read permissions across an organisation, compromise of a single token can expose multiple internal repositories.

Automated routines employed in the attack systematically clone repositories, inspect commit histories, and parse configuration files for sensitive patterns. The harvested credentials are then validated against external cloud platform endpoints to evaluate administrative access levels.

Rather than modifying source code or inserting malicious code into build pipelines, the primary focus of the Gheist operation appears to be initial access brokerage and direct credential harvesting across cloud environments.

Remediation and Secret Management Best Practices

Security teams are advised to review active personal access tokens, strictly enforce short token lifespan policies, and transition to fine-grained scoped tokens to restrict repository access.

Organisations should also ensure automated secret scanning is enabled across all code repositories and adopt dedicated secret management platforms rather than storing credentials in environment files or source code. Official documentation on managing GitHub tokens securely stresses the immediate revocation of exposed credentials and the enforcement of mandatory multi-factor authentication (MFA) across developer accounts.