Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

Summary from Wiz Blog.

Explained

The technology and terms in this story. Learn more