Gheist: Logs Indicate Over 900 Confirmed Compromises, Says DFIR Report
The Gheist campaign used stolen access tokens to commit malicious workflows into more than 13,500 GitHub branches and print repository secrets into Actions logs deleted seconds later, according to Wiz. The DFIR Report says the workflow could scan millions of internet-facing targets and that logs indicate more than 900 confirmed compromises. GitHub's approval hold does not cover private repositories or GitHub Enterprise Server; revoke exposed tokens and rotate compromised secrets, including cloud credentials.
What happened
Gheist campaign attackers used stolen access tokens to commit malicious workflows into more than 13,500 GitHub branches. The workflows printed repository secrets into Actions logs deleted seconds later, according to Wiz. Logs reviewed by The DFIR Report indicate more than 900 confirmed compromises.
Why it matters
Repository secrets, including cloud credentials, may have been exposed, opening the door to further access. GitHub's approval hold does not cover private repositories or GitHub Enterprise Server, where workflows ran, according to Wiz. Any company with repositories on GitHub is in scope.
What to do
Revoke exposed access tokens and rotate compromised secrets, including cloud credentials. Review unknown branches and workflows, especially ci-sync and sync-check.yml, and examine Actions logs.
For the technical team
- Affected
- Repositórios e branches no GitHub (workflows maliciosos via tokens de acesso roubados) · GitHub repositories and GitHub Actions reachable by a stolen token; private repositories and GitHub Enterprise Server are not covered by GitHub's public-repo approval hold, according to Wiz.
- Exploitation
- Large-scale exploitation reported by Wiz and Infosecurity Magazine: more than 13,500 branches and repositories targeted. The DFIR Report: logs indicate more than 900 confirmed compromises and the workflow could scan millions of internet-facing targets.
- Fix
- No patched version. Mitigation: revoke exposed tokens, rotate compromised secrets (including cloud credentials), and review unknown branches and workflows such as ci-sync and sync-check.yml.
- Vector
- Stolen GitHub access tokens created a ci-sync-<6 chars> branch with the file .github/workflows/sync-check.yml (commit message 'ci: sync config') in repositories reachable by the token. The workflow extracted repository secrets through GitHub Actions logs, deleted seconds later. GitHub's public-repo approval hold does not cover private repositories or GitHub Enterprise Server.
- More details
- Wiz says the attempted large-scale abuse stumbled. The DFIR Report published an analysis of the workflow's ability to scan millions of targets. The Wiz source records the incident start as September 15, 2026.
Timeline
The DFIR Report publishes analysis showing the malicious workflow could scan millions of internet-facing targets, with logs indicating more than 900 confirmed compromises.
Incident opened.
Wiz research on the 'Gheist' campaign details the method: stolen tokens created ci-sync branches with the sync-check.yml workflow to extract secrets from Actions logs, but the scaled attempt stumbled. Private repos and GitHub Enterprise Server are not covered by GitHub's public-repo approval hold.
Sources 4 sources
- Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles Wiz Research
- Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs The Hacker News
- Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens Infosecurity Magazine
- @TheDFIRReport @TheDFIRReport
