Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Gheist campaign steals GitHub tokens to exfiltrate secrets from private repositories.
A campaign dubbed Gheist has been discovered, compromising over 850 GitHub accounts and planting over 13,500 branches. The campaign uses stolen GitHub tokens to access private repositories, injects malicious workflows that exfiltrate secrets by encoding them to bypass GitHub's masking, and then deletes the evidence. This campaign poses a significant risk as it targets environment-scoped credentials, potentially including production secrets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Gheist campaign demonstrates how stolen access tokens can be weaponized to silently exfiltrate secrets from private repositories, bypassing GitHub's built-in secret masking through encoding tricks. Over 850 accounts were compromised, with malicious workflows injected and then deleted to cover the attacker's tracks, making detection extremely difficult. The core failure lies in over-privileged, long-lived tokens and insufficient controls around CI/CD workflow integrity. This matters because production-grade credentials harvested this way can enable cascading breaches across cloud environments, pipelines, and third-party services.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gheist
- mitre_attack — T1078.004
- mitre_attack — T1547.001
- mitre_attack — T1059.001
- mitre_attack — T1070.004
- mitre_attack — T1003.005
- mitre_attack — T1574.002