Gheist Campaign Exploits GitHub Actions for Secret Exfiltration

Since September 15, a large-scale automated campaign dubbed "Gheist" has been observed compromising GitHub repositories to steal environment secrets and cloud credentials. The threat actor uses stolen GitHub tokens, likely sourced from infostealer logs and previous supply-chain compromises, to create new branches and push malicious GitHub Action workflows. While GitHub's automated safeguards have largely mitigated the threat in public repositories, private repositories and GitHub Enterprise Server instances remain vulnerable as they often bypass these default approval requirements.

The attack chain involves the creation of a specifically named branch (`ci-sync-[random]`) followed by the commitment of a workflow file designed to print all repository secrets into the build logs. By encoding these secrets in base32, the attackers successfully bypass GitHub's native log masking. After the secrets are printed, the attacker downloads the logs via the GitHub API and deletes the run within seconds to minimize their footprint. There is also evidence of overlap with other malicious activity, including North Korean-linked PolinRider malware and the GhostAction campaign.

This campaign represents a significant risk to organizations using GitHub for CI/CD, particularly those relying on OIDC for cloud authentication or utilizing self-hosted runners. Successful exploitation allows for the theft of production credentials, AWS roles, and Kubernetes service account tokens, potentially leading to widespread downstream cloud environment compromises.