[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyE3bF0u5aBRP4rt1M-jtWth6PcrGAfMa0kz6iEAjQmU":3},{"article":4,"iocs":56,"watch_terms":79,"solutions":80,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"01b8714f-534a-41ff-ab1c-6533bc148a1f","Private repos still leak secrets to Gheist, a stolen GitHub token campaign","private-repos-still-leak-secrets-to-gheist-a-stolen-github-token-campaign-6e708b","Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository’s secrets into a log, and the attacker downloads it. The exposure is in private repositories. A … More → The post Private repos still leak secrets to Gheist, a stolen GitHub token campaign appeared first on Help Net Security.","A campaign dubbed Gheist has been discovered, compromising over 850 GitHub accounts and planting over 13,500 branches. The campaign uses stolen GitHub tokens to access private repositories, injects malicious workflows that exfiltrate secrets by encoding them to bypass GitHub's masking, and then deletes the evidence. This campaign poses a significant risk as it targets environment-scoped credentials, potentially including production secrets.","Gheist campaign steals GitHub tokens to exfiltrate secrets from private repositories.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Fgheist-github-token-abuse\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F07\u002F24161318\u002Fgithub-ghost.webp","2026-10-27T10:58:07+00:00","2026-10-27T12:00:11.836074+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Gheist","threat_actor",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":25},"GitHub Actions","product",{"name":27,"type":25},"GitHub API",{"name":29,"type":22},"Wiz Research",{"name":31,"type":32},"OIDC","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,64,67,70,73,76],{"type":58,"value":18,"context":59},"malware","Name of the campaign\u002Ftool discovered by Wiz Research",{"type":61,"value":62,"context":63},"mitre_attack","T1078.004","Valid Accounts: Cloud Accounts (used stolen GitHub tokens)",{"type":61,"value":65,"context":66},"T1547.001","Boot or Logon Autostart Execution: Registry Run Keys \u002F Startup Folder (implied by workflow execution)",{"type":61,"value":68,"context":69},"T1059.001","Command and Scripting Interpreter: PowerShell (potential for workflow execution)",{"type":61,"value":71,"context":72},"T1070.004","Indicator Removal: File Deletion (workflow logs and branches deleted)",{"type":61,"value":74,"context":75},"T1003.005","OS Credential Dumping: Mimikatz (implied by self-hosted runner token\u002Fkey exfiltration)",{"type":61,"value":77,"context":78},"T1574.002","Hijack Execution Flow: DLL Side-Loading (potential for workflow execution)",[21,29,24],{"controls":81,"vendors":162},[82,111,139],{"slug":83,"name":84,"problem":85,"products":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":112,"name":113,"problem":114,"products":115},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":133,"vendor_name":21,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":140,"name":141,"problem":142,"products":143},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[144,152,157],{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":153,"product_name":154,"url":155,"description":156},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":158,"product_name":159,"url":160,"description":161},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[163,166],{"slug":133,"name":21,"logo_path":134,"roles":164},[165],"affected",{"slug":167,"name":168,"logo_path":169,"roles":170},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[171],"reported_by",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":184},"stolen-github-tokens-expose-private-repo-secrets-in-gheist-campaign","Stolen GitHub Tokens Expose Private Repo Secrets in Gheist Campaign","The Gheist campaign demonstrates how stolen access tokens can be weaponized to silently exfiltrate secrets from private repositories, bypassing GitHub's built-in secret masking through encoding tricks. Over 850 accounts were compromised, with malicious workflows injected and then deleted to cover the attacker's tracks, making detection extremely difficult. The core failure lies in over-privileged, long-lived tokens and insufficient controls around CI\u002FCD workflow integrity. This matters because production-grade credentials harvested this way can enable cascading breaches across cloud environments, pipelines, and third-party services.",[177,178,179,180,181,182,183],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1528: Steal Application Access Token","CIS Control 8: Audit Log Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":185,"CIS Control 5: Account Management":186,"CIS Control 8: Audit Log Management":187,"NIST SP 800-53 SI-2: Flaw Remediation":188,"MITRE ATT&CK T1528: Steal Application Access Token":189,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":190,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":191},"NIS2 requires entities to implement controls around access management and incident handling for supply chain and CI\u002FCD environments, directly applicable to preventing and detecting stolen token abuse in software development pipelines.","The campaign relied on stolen, long-lived GitHub tokens with broad permissions; enforcing least-privilege access and mandatory token expiration would have limited the blast radius of any single compromised token.","The campaign deleted branches and workflows to erase evidence; robust, tamper-resistant audit logging of GitHub Actions runs and repository events would have preserved forensic data and enabled earlier detection.","Regularly auditing CI\u002FCD pipeline configurations and workflow files for unauthorized changes is analogous to flaw remediation — catching malicious injections before they execute and exfiltrate secrets.","Gheist directly exploits stolen GitHub access tokens to authenticate to private repositories, matching this technique's definition of abusing stolen OAuth or API tokens to gain unauthorized access.","Organizations should maintain awareness of misconfigurations and insecure practices in their software supply chain tooling, including over-privileged tokens in GitHub, as technical vulnerabilities requiring remediation.","Proper identity and access controls — including short-lived, scoped credentials and multi-factor authentication for repository access — would have reduced attackers' ability to authenticate using stolen tokens."]