Wiz details Gheist, a campaign using stolen GitHub tokens to plant secret-dumping workflows in private and enterprise repos

Wiz Research says it has tracked Gheist since Sept. 15: stolen tokens push a sync-check workflow to every reachable repo, print secrets base32-encoded to evade log masking, then pull the log and delete the run. It found over 13,500 planted branches from 850+ accounts. GitHub's approval hold blocked public-repo runs, but private repos and GitHub Enterprise saw successful exploitation.

Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.