Gheist campaign abuses stolen GitHub tokens to harvest cloud secrets

· Cybersecurity

An ongoing supply chain attack dubbed Gheist is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which attackers then download before deleting the runs. According to analyses cited by Dark Reading and The Hacker News, the automated campaign is harvesting credentials and sensitive data from thousands of developer repositories. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to cloud security researchers. The technique abuses GitHub's own automation infrastructure rather than an external vulnerability, making detection harder for teams that treat CI logs as low-risk. Developer supply chains and cloud credentials are the immediate exposure.

Why it matters：CI/CD pipelines are a high-value, often under-monitored path into cloud environments, and a campaign that turns GitHub's own logs into an exfiltration channel challenges standard supply-chain defenses.

Key points

  • Attackers plant workflows that print repository secrets into GitHub Actions logs
  • Runs are deleted after the logs are downloaded
  • Private repositories and GitHub Enterprise environments were successfully hit

Sources (original reporting)

More stories from this day