Gheist Attacks Use Stolen Tokens to Exfiltrate GitHub Actions Secrets

An automated cyberattack campaign named Gheist is targeting private GitHub repositories and enterprise environments to exfiltrate sensitive secrets. The operation uses stolen GitHub access tokens to abuse legitimate automation features, specifically targeting the logs generated by GitHub Actions.

According to researchers at the cloud security firm Wiz, the attackers have successfully compromised numerous private repositories and GitHub Enterprise instances. The campaign demonstrates the growing risk of “non-human identity” compromise, where automated tokens are used as a gateway for lateral movement and data theft within development environments.

Secrets Leaked via Malicious Workflows

The Gheist campaign functions by using stolen GitHub tokens to plant malicious workflow files within a target repository. These workflows are configured to run automatically and execute commands that print the repository’s stored secrets—such as API keys, cloud credentials, and database passwords—directly into the GitHub Actions logs.

Once the workflow has executed and the secrets are visible in the plaintext logs, the automated system downloads the logs and promptly deletes the workflow runs. By removing the history of the run, the attackers aim to hide their activity from security teams and repository administrators.

GitHub Safeguards and Mitigation

GitHub has acknowledged the threat and implemented a safeguard designed to detect and pause workflows that exhibit suspicious behaviour typical of the Gheist campaign. However, the success of the attacks against private and enterprise systems suggests that organisations must take additional steps to secure their CI/CD (Continuous Integration and Continuous Deployment) pipelines.

Security experts recommend that organisations conduct regular audits of their GitHub personal access tokens (PATs) and move towards short-lived, fine-grained tokens where possible. Monitoring GitHub Actions for the creation of unexpected workflow files and reviewing audit logs for unusual deletion activity are also critical for identifying ongoing exfiltration attempts.

The incident highlights the importance of protecting non-human identities, as a single compromised token can provide attackers with broad access to a company’s internal codebases and sensitive credentials without triggering traditional multi-factor authentication (MFA) alerts.