Wiz has documented an automated campaign, tracked since 15 September and named Gheist after the user agent its tool sends to the GitHub API, that uses stolen GitHub tokens to plant workflows which print a repository's secrets into its Actions logs; the attackers download those logs and then delete the runs. Each workflow is pushed to a new branch named ci-sync- followed by six random characters, and removing the branch or the run does not undo the exposure — every secret the repository could read must be rotated, and the pushing token revoked. Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts, spanning personal projects and enterprise private repositories. A GitHub safeguard that pauses suspicious workflow runs stopped every public-repository run Wiz examined, but it does not cover private repositories or GitHub Enterprise Server. In enterprise environments the tool cycled through several users' and automation accounts' tokens within minutes and cloned private repositories before planting the workflow; hours later, cloud credentials from the same organisation were used to enumerate AWS Secrets Manager. As of 24 October the campaign was still running, and roughly two-thirds of the accounts involved had since disappeared from GitHub.

• Source article