Gheist uses stolen GitHub tokens to dump repository secrets through Actions logs
Wiz reports over 13,500 planted branches across over 850 compromised accounts. Stolen tokens push secret-dumping workflows; successful execution was observed in private repositories and enterprise environments. Revoke tokens and rotate exposed secrets.
- Disclosed
- Oct 25, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Repositories writable by stolen workflow-capable tokens; private repositories and GHES lack GitHub's public-repository approval hold
- github-actions
- In the wild
- Yes
- Wiz observed private-repository execution and follow-on AWS Secrets Manager enumeration.
What happened
The attacker needs a stolen token capable of pushing workflows. Encoded secrets evade verbatim log masking; the attacker retrieves logs through GitHub’s API, then deletes runs. An environment matrix can reach secrets where environment protections permit the job to run. Wiz’s branch/account totals are not counts of successful exfiltrations.
GitHub’s automatic hold stopped every public-repository run Wiz examined; it does not cover private repositories or GitHub Enterprise Server. This does not establish that every public workflow is safe. The self-hosted payload also attempts host, Docker and metadata collection, but Wiz found bugs: it used the wrong runner key file, had a broken URL-credential regex and did not collect GCP or Azure tokens.
This is distinct from GhostAction: shared credential-abuse tactics do not establish a common operator. No software patch substitutes for token revocation and secret rotation. L4 reflects observed secret theft and follow-on cloud activity.
Crime-scene timeline
Sep 15, 2026
Wiz begins tracking the campaign
Oct 19, 2026
A variant adds a self-hosted runner job
Oct 24, 2026
Wiz's observation cutoff still shows ongoing activity
Oct 25, 2026
Wiz publishes the campaign investigation
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Wiz Gheist investigationPrimaryOctober 25 primary investigation: account/branch counts, observed private-repository execution, complete indicators, payload limitations and response steps.
- GitHub malicious-workflow approval protectionPrimaryCertain suspicious runs require approval from a write collaborator via an authenticated web session; applies to public github.com repositories, not private repositories or GHES.