Covered by 2 outlets — first reported by The Hacker News, Oct 26, 07:49 UTC
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
MentionsGitHub
Summary
An automated campaign dubbed Gheist is using stolen GitHub access tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download. The Hacker News, citing analysis by cloud security company Wiz, reports the attacks have worked in private repositories and GitHub Enterprise environments, and that the attackers delete the runs afterwards. Help Net Security says Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Help Net Security. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs.
Help Net Security
Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests.
Explained
The technology and terms in this story. Learn more