A GitHub-focused campaign attributed to “Gheist” uses stolen access tokens to compromise repositories and harvest secrets. The activity relies on workflows that print sensitive data into GitHub Actions logs, which the attackers then download, according to reporting that cites analysis by a cloud security firm.
Outlets describe the scale as reaching thousands of branches and repositories, with targets including private repositories and GitHub Enterprise environments. The method is presented as automated: after inserting the workflow, the attackers retrieve the leaked information from the logs and then remove or clean up the runs. This framing emphasizes the abuse of GitHub’s automation features rather than direct credential theft from end users.
Across coverage, the core details remain consistent—stolen GitHub tokens, workflow-based secret dumping via Actions logs, and successful access to private environments—while attention varies in how broadly the campaign is quantified and how much technical mechanism is highlighted.
