Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign called Gheist is using stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs before deleting the runs.
The campaign, tracked since September 15 by cloud security company Wiz, creates branches named ci-sync- followed by six random characters in compromised repositories. Each branch contains a workflow file that prints all accessible secrets in base32 format to GitHub Actions logs, which attackers then download before deleting the runs. The attacks have successfully targeted private repositories and GitHub Enterprise environments.
Scope of Attacks
Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts, ranging from personal projects to enterprise organizations. In enterprise environments, the tool cycles through multiple tokens within minutes, clones private repositories, and later uses cloud credentials to enumerate AWS Secrets Manager. As of October 24, the campaign was still active, with about two-thirds of the involved accounts no longer available on GitHub, likely due to responses from affected organizations.
Anyone with write access to a GitHub repository can read every secret configured in it, according to GitHub's documentation.
Attack Mechanism
For each accessible repository, the tool creates a ci-sync- branch and commits a file named .github/workflows/sync-check.yml with the message 'ci: sync config'. The workflow prints all environment variables and secrets the job can access, using base32 encoding to bypass GitHub's secret masking. After downloading the logs through GitHub's API, the attackers delete the run, leaving no external connections to block.
Since July 28, GitHub has held potentially malicious workflow runs for approval in public repositories, which has prevented all public Gheist runs from executing. However, this safeguard does not apply to private repositories or GitHub Enterprise Server.
Detection and Response
Wiz recommends checking for ci-sync- branches with specific characteristics, examining GitHub audit logs for deleted workflow runs, and monitoring cloud audit logs for role assumptions involving these branches. For affected repositories, they advise rotating all secrets, revoking compromised tokens, and treating self-hosted runners as compromised if they executed the malicious workflows.
To prevent future attacks, organizations should require reviewers for environments with production secrets, limit OIDC trust policies to protected branches, use GitHub Apps or fine-grained tokens instead of personal access tokens, and run self-hosted runners as short-lived machines with restricted access.
Related
