Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Summary
Wiz Research tracks Gheist, a campaign that auto-installs secret-dumping GitHub workflows into repositories with stolen tokens. The attack exfiltrates secrets via GitHub Actions logs and private repos, evolving across two variants and leveraging private enterprise environments. The article also outlines indicators of compromise and recommended defense actions, highlighting the ongoing risk to CI/CD pipelines and cloud credentials.