Gheist campaign steals GitHub repo secrets using stolen tokens
An automated campaign dubbed Gheist uses stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs, then downloads the logs before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, affecting thousands of developer repositories, according to cloud security firm Wiz. The operation is described as an ongoing supply‑chain attack harvesting credentials and sensitive data.
Why it matters: Developers must secure token access and monitor Actions logs to prevent large‑scale secret leakage.
Read the coverage
More in Security
Security11h ago2 sources
Security13h ago2 sources
Security16h ago2 sources