Gheist Campaign Abuses Stolen GitHub Tokens to Pull Secrets From Private Code Repositories

Since 15 September 2026, Wiz Research has been tracking a campaign it calls Gheist, named after the user agent in its requests. Attackers use compromised GitHub tokens to add a workflow called sync-check to every repository the token can access. The workflow tries to print the repository's stored secrets into its own log. The tool then downloads that log through the GitHub API and deletes the run seconds later. Because the secrets leave through GitHub itself, there is no attacker domain or outbound connection for a business to block.

Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts, covering personal projects through to private repositories at enterprise organisations. A recent GitHub control has been blocking the exploitation in public repositories. However, Wiz observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments. In one enterprise case, the tool cycled through tokens belonging to several users and automation accounts within minutes and cloned private repositories. Hours later, cloud credentials from the same organisation were used to enumerate AWS Secrets Manager.

Wiz notes that GitHub only masks secret values in logs when they appear verbatim, so an encoded secret is printed in full. Secrets tied to deployment environments, often production credentials, can also be exposed. Roughly two thirds of the implicated accounts are no longer available on GitHub, which likely reflects response activity after Wiz reported the campaign.