Stolen GitHub tokens fuelled a campaign that planted malicious GitHub Actions workflows to steal repository and cloud credentials.
In a sophisticated and highly targeted campaign that has sent shockwaves through the DevOps and cybersecurity communities, a threat actor identified as "Gheist" has weaponized GitHub Actions to exfiltrate sensitive credentials from private and enterprise-level repositories. The campaign, which has been under rigorous investigation by researchers at Wiz since its discovery on September 15, represents a significant evolution in how adversaries exploit automation pipelines to harvest secrets from cloud-native environments.
The Mechanism of the Attack
The Gheist campaign operates by gaining unauthorized access to legitimate GitHub accounts, typically through stolen personal access tokens (PATs) or session cookies obtained via information-stealing malware. Once inside an account, the attackers do not immediately trigger an alarm; instead, they operate with a degree of stealth that has allowed them to compromise over 850 accounts and create more than 13,500 malicious branches across various repositories.
The core of the attack lies in the abuse of GitHub Actions, the integrated automation platform that allows developers to streamline their CI/CD pipelines. The attackers programmatically inject a workflow file—often disguised with the innocuous title "sync-check"—into the target repository. This workflow is designed to execute immediately upon being pushed to a branch. The script’s primary objective is to force the repository to reveal its environment secrets, which are then encoded into Base32.
This encoding step is critical because it allows the stolen data to bypass GitHub’s native secret-masking algorithms. GitHub’s security architecture is designed to redact sensitive values like API keys or passwords if they are printed directly into logs; however, because the Gheist workflow modifies the data into a different format before printing, the system fails to recognize the sensitive nature of the information. Once the logs are generated containing the base32-encoded secrets, the attackers utilize the GitHub API to fetch these logs remotely. To further complicate detection, the malicious workflow is configured to delete itself mere seconds after execution, leaving behind minimal forensic evidence for repository owners to discover.
Chronology of Discovery and Escalation
The threat was first identified by Wiz Research on September 15, 2026. Initial analysis indicated that the attackers were not merely interested in source code, but were actively seeking the "keys to the kingdom"—the cloud credentials and infrastructure secrets stored within the CI/CD environment.
By late September, the scope of the campaign had expanded significantly. Researchers observed that the Gheist threat actor had begun to evolve its methodology, moving from basic secret theft to a more aggressive reconnaissance phase. The newer iterations of the malicious workflows were observed attempting to access self-hosted GitHub runners. By gaining access to these runner hosts, the attackers could inspect environment files, extract Docker socket configurations, and capture Kubernetes service-account tokens.
The timeline of the attack suggests a well-orchestrated effort to move laterally from the source code repository into the broader cloud infrastructure of the victimized organizations. In several instances, Wiz observed that cloud credentials extracted from these workflows were used within mere hours to enumerate AWS Secrets Manager, signaling a rapid transition from initial access to full-scale cloud exploitation.
Supporting Data and Statistical Impact
The scale of the Gheist operation is unprecedented in the context of automated CI/CD abuse. With over 13,500 malicious branches detected, the breadth of the campaign suggests that the attackers are utilizing automated scripting to maximize their footprint.
Data from the investigation reveals that the compromised accounts are not restricted to small, low-security projects. Instead, they span a diverse range of personal projects and private enterprise repositories. This indicates that the initial point of entry—likely infostealer logs—is highly effective at targeting developers who have elevated permissions within professional or corporate organizations.
The overlap between Gheist and other known supply-chain incidents is also notable. Researchers have identified that many of the accounts affected by Gheist had previously been compromised in earlier, unrelated events, such as the March 2026 Trivy supply-chain compromise. This suggests that once an account is compromised, it often remains a persistent target for multiple threat actors, creating a cumulative risk profile for the victim.
Official Responses and Mitigation Measures
GitHub has implemented several layers of protection to curb the abuse of its platform. Specifically, the company introduced a control mechanism that requires manual collaborator approval before workflow runs can execute in public repositories. This measure has proven successful in neutralizing the threat for public-facing codebases.
However, a significant security gap remains for private repositories and GitHub Enterprise Server instances, where the requirement for collaborator approval is not enforced by default. In these environments, the Gheist workflows continue to execute successfully.
Wiz has issued a comprehensive advisory for security teams, recommending the following defensive actions:
- Auditing Repository Activity: Security teams should proactively search for branches named "ci-sync-" followed by six random characters.
- Reviewing Commit History: Scrutinize commit titles for "ci: sync config," which is a hallmark of the Gheist workflow injection.
- Log Analysis: Look for workflow runs that complete and are immediately deleted. Because the deletion occurs within seconds, standard audit logs may be the only record of the event.
- Credential Rotation: If an account is suspected of compromise, rotating all repository, organization, and environment secrets is mandatory. Deleting the malicious branch does not invalidate secrets that may have already been exfiltrated.
- Monitoring Cloud Logs: Organizations should monitor CloudTrail records for anomalous role assumptions that coincide with the timing of CI/CD pipeline activities.
Broader Implications for Cloud Security
The Gheist campaign serves as a sobering reminder of the "shared responsibility" model in cloud security. While GitHub provides the platform and tools for automation, the security of the secrets stored within those tools rests squarely on the shoulders of the organization. The reliance on CI/CD pipelines to manage infrastructure, deploy code, and store sensitive credentials has effectively turned these pipelines into high-value targets for adversaries.
The use of Base32 encoding to bypass standard security filters highlights an ongoing "arms race" between platform security features and threat actors. As platforms like GitHub introduce more robust masking and monitoring, attackers are consistently finding ways to exploit the underlying logic of how these systems parse and execute code.
Furthermore, the targeting of self-hosted runners emphasizes that developers and IT operations teams must treat their CI/CD runners with the same level of security rigor as their production cloud instances. A compromise of a runner is, effectively, a compromise of the entire environment to which that runner has access.
As organizations continue to integrate AI-driven development tools and automated testing suites, the attack surface for CI/CD pipelines will likely expand. The Gheist campaign is not an isolated event; it is a signal that the automation layer of the software development lifecycle is now a frontline battleground in modern cybersecurity. Security professionals must shift their focus toward implementing "Zero Trust" principles within their CI/CD workflows, ensuring that even if a pipeline is compromised, the blast radius of any stolen credentials is limited by strict role-based access controls and ephemeral secret management.
The path forward for enterprise security requires a more granular approach to visibility. Organizations must move beyond basic branch protection and start implementing runtime security monitoring within their CI/CD environments. Only by maintaining rigorous oversight of the "automation of automation" can companies hope to defend against adversaries who are as sophisticated and persistent as the Gheist collective. The incident remains a critical case study in the necessity of constant vigilance, rapid incident response, and the continuous auditing of the automated processes that underpin the modern digital economy.
