Gheist campaign uses stolen GitHub tokens to leak private repository secrets through Actions logs

Wiz detailed Gheist, an automated campaign that uses stolen GitHub tokens to push a sync-check.yml workflow to a short-lived ci-sync branch, then reads the job's secrets from the run log. The workflow base32-encodes every secret the job can access, defeating GitHub's log masking, downloads the log through the API, and deletes the run seconds later, so nothing leaves through an attacker server. Since September 15, Wiz recovered more than 13,500 planted branches across more than 850 compromised accounts, succeeding in private repositories and GitHub Enterprise, where GitHub's hold on suspicious runs does not apply. Rotate every reachable secret, since deleting branches does not undo exposure.

Check

Hunt for ci-sync branches containing only a sync-check.yml workflow and runs deleted shortly after finishing, and rotate every secret those repositories could access.

Affected

Private GitHub repositories and Enterprise servers reachable with a stolen token can have all their accessible secrets leaked through a planted workflow's run logs.

Fix

Rotate repository, organization, and environment secrets, revoke the tokens that pushed commits, prefer short-lived fine-grained tokens, and require reviewers on environments holding production secrets.