Threat Intelligence
Get the briefing
Threat Intelligence

Ongoing 'Gheist' Attack Turns GitHub Tokens Into a Way to Steal Cloud Secrets

Dark Reading · 27 Oct 2026
Key Takeaway Review and rotate your GitHub tokens and any cloud credentials stored in code repositories, and remove any secrets that do not need to be there.

Dark Reading reports that an ongoing supply chain attack, referred to as 'Gheist', is weaponising GitHub tokens to steal cloud secrets. The campaign is harvesting credentials and sensitive data from thousands of developer repositories.

Supply chain attacks target the tools and code that businesses already trust, rather than attacking each business directly. Developer repositories often hold access keys and other secrets that connect to cloud services, which makes them a valuable target. If those secrets are exposed, attackers may be able to reach the cloud systems behind them.

The summary provided does not detail how the attack spreads or who is behind it. Any business that builds software, or relies on code hosted on GitHub, should treat this as a prompt to check how its tokens and secrets are managed.

supply chain attack GitHub credential theft cloud security
Read original source -> Get the news API, A$10 a month
Answering to more than one framework? Run them as one security and AI governance programme ->

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.