Skip to content
securitytabs

Covered by 2 outlets — first reported by Wiz Blog, Oct 25, 17:55 UTC

Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

MentionsGitHub

Summary

Wiz says an automated campaign it calls Gheist is using stolen GitHub access tokens to plant workflows that dump secrets in every repository the tokens can reach. Wiz says it uses no command-and-control server, is still evolving, and has been significantly disrupted by recent GitHub security improvements. Infosecurity Magazine reports the campaign targeted more than 13,500 branches and repositories.

AI summary by the SecurityTabs newsroom, checked against Wiz Blog, Infosecurity Magazine. Read the outlets below for the full story.

Continue reading

2 outlets, in the order they reported it.

  1. Wiz BlogFirst report

    Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

    An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

    Read at Wiz Blog Details

  2. Infosecurity Magazine

    Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens

    A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows

    Read at Infosecurity Magazine Details

Explained

The technology and terms in this story. Learn more