Executive Summary
Since September 15, 2026, a campaign dubbed 'Gheist' has been observed performing mass abuse of compromised GitHub tokens to exfiltrate secrets from over 850 accounts. The threat actor automates the creation of a 'sync-check' workflow in targeted repositories, which bypasses GitHub's secret masking by base32-encoding repository and environment-scoped secrets before printing them to workflow logs. While GitHub's approval controls have mitigated impacts in public repositories, private and enterprise environments remain vulnerable and have seen follow-on activity, including cloud credential enumeration.
Technically, the campaign involves two main tool variants that create branches using specific naming conventions (e.g., ci-sync- followed by six characters). A more advanced variant, 'Tool B', attempts to pivot to self-hosted runners to harvest host details, process environments, and cloud metadata (AWS, GCP, Azure). The campaign shows significant overlap with other threat activity, including the North Korean-linked PolinRider malware and the Megalodon campaign, suggesting a vibrant ecosystem for stolen credential exchange.
This activity represents a critical risk to organizations using GitHub Actions, particularly those with private repositories or self-hosted infrastructure. The ability to exfiltrate production-level credentials through GitHub's own API without requiring an external C2 domain makes detection challenging. Organizations should prioritize rotating secrets, reviewing OIDC trust policies, and monitoring for the specific indicators identified in this report.