Private repos still leak secrets to Gheist, a stolen GitHub token campaign

Help Net SecurityOctober 27, 2026Threat Intel AppSec

Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository’s secrets into a log, and the attacker downloads it.

Summary from Help Net Security.

Read the full article at Help Net Security

Full story2 outlets are covering this story. Read the summary and every outlet's coverage

Other sources covering the same vulnerabilities or event.

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

The Hacker Newsyesterday

Private repos still leak secrets to Gheist, a stolen GitHub token campaign

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

More in Threat Intel

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)

Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected

Related coverage

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

More in Threat Intel

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)

Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected