Gheist：企图大规模滥用被盗的GitHub Tokens Stumbles
一个自动化的运动是在每一个被盗的GitHub信物可以到达的存储处安装秘密倾销工作流程。 它使用没有C2服务器，正在积极演化，并被近期的GitHub安全改进显著中断。
自2026年9月15日起，Wiz Research开始追踪Gheist：进行大规模滥用失密的GitHub令牌的新活动。 攻击对每个信使可以访问的每个寄存器进行名为同步检查的工作流程。 工作流程试图将存储器的秘密打印到自己的工作流程日志中。 然后，工具通过GitHub API下载日志，并在之后删除运行秒。 该工具的API请求载有用户agent gheist，它给出了运动的名称。
我们从850多个被破坏的账户中，从个人项目到企业组织的私人储存库中，追回了13 500多个植入的分支。
近期的GitHub控制已经阻止了公共储存库的开采，但我们观察到在私人储存库和GitHub企业环境中的开采和后续活动取得了成功。
截止10月24日：
攻击正在进行中
大约2⁄3个涉及的账户已无法在GitHub上找到。 这很可能表明反应活动，因为我们已向GitHub报告这一活动。
如何发动攻击
对于每个寄存器，该工具创建了一个名为ci-sync-的分支加六个随机字符，然后将.github/workflows/sync-check.yml与消息ci：同步配置。 承诺没有署名，并被写作是信物的主人。 推推事件触发工作流程：
GitHub只在日志中逐字显示时才会隐藏秘密值。 一个基数32编码的密件不匹配，所以完全打印出来。
虽然权限：QQ限制任务GITHUB TOKEN，攻击者不需要，但并不限制机密背景。
当寄存器有部署环境时，该工具会将它们列在一个带有环境的工作矩阵中：${{矩阵。 Environment QQ，因此环境范围的秘密，常常是生产证书，也会被打印出来。
由于这些秘密通过GitHub自己的API离开，因此没有攻击者域或外出连接来阻断。
在企业组织中，我们看到工具循环在几分钟内通过几个用户的代号以及自动化账户，在植入工作流程前克隆私人寄存器，数小时后，同一组织的云证书用于列举AWS秘密管理员。
有效载荷是如何演变的
这种攻击的两个变种被平行观测。 它们可以通过分支名称区分。
工具A使用十六进制后缀和普通有效载荷。
工具B使用一个基数36后缀，增加了超时分钟：6以及环境矩阵在9月28日首次运行后的数小时内，并修改了每个存储器中选定的有效载荷。
10月19日，工具B在垃圾堆之间增加了回声X QQ Base32 -w 120，其中打印LAFAQQ作为分隔符，可能是操作员的日志解析器。 几个小时后，它推了第二个工作，同步主机，与跑步：自我托管，显然只到仓库与注册的自我托管的跑步者。 它写了三个帮助文件(.gdmp pat,.gdmp patg,.gdmp sweep)，并在一个QQ gdmp-pivot: <stage>下记录每个阶段。 QQ 标题：
主机细节和crontab.
对主目录，工作空间和系统路径进行递归性搜索，用于31个令牌格式(包括Anthropic,Hugging Face,Groq和NVIDIA等AI提供者的密钥)，私钥，.env文件，Terraform状态和 shell历史。
每个过程的环境，从/proc/*/environ.
通过 Docker 套接字，装有主机根文件系统的容器，在主机上重复搜索。
AWS实例作用证书，加上GCP和Azure元数据。
GitHub动作和GitLab跑者证书文件。
Kubernetes服务账户代币。
然而，这个工作是buggy的：它寻找错误的跑车密钥文件，它的URL证书Regex被打破，它不收集GCP或Azure令牌。
GitHub的核准持有量和私人存放量
自2026年7月28日起，GitHub在公共库中举办了潜在的恶意工作流程运行，直到合作者批准。 包括自办工作在内的所有变体都坐着行动控制有效恶意有效载荷从未运行过
不幸的是，这个控件不适用于私人寄存器或GitHub企业服务器。 在那里，GitHub审计日志显示在ci-sync-*分支上运行完成，然后被gheist用户agent删除。 CloudTrail 显示是这些组织在这些分支上运行并承担AWS角色的自身工作流程，这证明了未经批准而执行的行动。
对于维权者，最后一个信号发现 Gheist没有任何GitHub日志，如下所示。
在同一账户上的其他活动
这场运动正在影响GitHub的接入。 其他行为者和运动也使用同样的说法，这表明在威胁行为者的生态系统中如何损害信誉。 我们观察到与以下运动的重叠：
露蕾寄存器(疟疾分发). 10月6日，391个账户重新命名了大约1,461个寄存器，用于像fl-studio-crack和Solana-sniper-lite这样的破解软件诱导。 重名擦除610个ci-sync分支作为副作用。 其中166个账户从未出现在Gheist活动中，因此该池比Gheist的足迹更大。
免费计算( cryptomining). 10月18日，25个Gheist账户各在9分钟内创建了"Windows RDP Runner"寄存器，试图滥用GitHub Actions免费计算周期。
宝林瑞德。 一些受害者似乎感染了PolinRider，该软件与朝鲜有关，10月19日和20日，三名受害者用装填器重新加压了他们的Gheist。 调伏。 js后面的数百个白空间字符，在两个情况中，api.js 该软件包.json运行在每一个dev和构建之前。
兆龙。 盖斯特第一阶段的57个说法也是5月梅加洛顿的受害者。
我们可以追踪到的可靠来源符合这张照片：信息化者日志，以及3月份的Trivy妥协等早期供应链妥协中暴露的标志。
注：Gheist与Ghost Action不同，Ghost Action使用不同的工作流程文件，并将秘密泄露至193.32.204[.]199.
安全小组应采取什么行动？
韩特
查找名为ci-sync-的分支，然后是6个随机字符，其中唯一的变化是在.github/workflows/sync-check.yml与承诺消息ci：同步配置。
在GitHub审计日志中，寻找在完成后一分钟内删除的ci-sync-*分支上的工作流程，以及用户agentgheist中的任何活动。
如果您的工作流程以 OIDC 对云进行认证，请检查云审计日志中的角色假设或信使交换，其对象包括一个 Ci- sync- 分支。 显示 GitHub Actions运行在攻击者分支上，即使你不收集GitHub日志。
在自办的运行器上，查找文件.gdmp pat,.gdmp patg和.gdmp sweep，以及工作日志中的字符串 gdmp-pivot.
响应
旋转每个存放处、组织和环境机密，供受影响的存放处使用。 删除运行或分支不会解除曝光。
撤销推动承诺的标志，检查他们的主人的装置的化粪工。
如果一个Ci-sync分支运行在自营的跑者身上，则将主机及其实例角色视为妥协。
不要批准同步检查运行，不要运行代码从Ci -sync分支。
汉登要求审查有生产秘密的环境，范围OIDC对受保护分支或环境的信任政策，使用GitHub Apps或短寿命的精细纹章而非个人访问纹章，并在没有Docker套接字或不受限制的元数据访问的情况下作为电源主机运行自备跑者。
妥协指标
用户 agent 光学
分支 Ci-sync - 后面六个字符，匹配 ^ci-sync- [0-9a-z]{6} $
提交消息 ci：同步配置只添加。 github/ workflows/ sync- check.yml
威胁中心的咨询包括一个事件探索者查询，涵盖植入式承诺、GitHub审计日志中的Gheist活动和攻击者分支的云作用假设。 Wiz Defense通过包括"新工作流程完成并在短时间时段删除","工作流程通过秘密倾斜推进"和"承诺通过已知恶意提交信息"在内的规则来检测活动。
Wiz Research正在追踪一个使用ARTEX的演员，与Storm-0940重叠，跨越多个目标软件供应商。 学习AI agent如何攻击Okta,Entra和Cognitto，以及它留下的日志中的内容。
获取个性化演示
准备好看到Wiz行动了吗？
"我见过的最好的用户体验，为云量的工作提供了充分的可见度".
大卫·埃斯利克科
"Wiz提供单一的玻璃板来观察我们的云层环境".
亚当·弗莱彻首席警卫
"我们知道，如果Wiz识别出一些关键的东西，它实际上是。"
威胁和脆弱性管理主任
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has access. The workflow seeks to print the repository's secrets into its own workflow log. Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent gheist, which gives the campaign its name.
We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories.
A recent GitHub control has been blocking the exploitation in public repositories, but we've observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments.
As of October 24:
the attack is ongoing and evolving
roughly ⅔ of implicated accounts are no longer available on GitHub. This likely indicates response activity, as we have reported this activity to GitHub.
How the attack works
For each repository, the tool creates a branch named ci-sync- plus six random characters, then commits .github/workflows/sync-check.yml with the message ci: sync config. The commit is unsigned and authored as the token's owner. The push event triggers the workflow:
GitHub masks secret values in logs only when they appear verbatim. A base32-encoded secret doesn't match, so it prints in full.
While permissions: {} restricts the job's GITHUB_TOKEN, which the attacker doesn't need, it doesn't restrict the secrets context.
When a repository has deployment environments, the tool lists them in a job matrix with environment: ${{ matrix.environment }}, so environment-scoped secrets, often production credentials, are printed too.
Because the secrets leave through GitHub's own API, there is no attacker domain or outbound connection to block.
In enterprise organizations, we saw the tool cycle through tokens of several users and automation accounts within minutes, clone private repositories before planting the workflow, and hours later, cloud credentials from the same organization used to enumerate AWS Secrets Manager.
How the payload evolved
Two variants of this attack have been observed in parallel. They can be distinguished via the branch names.
Tool A uses a hexadecimal suffix and the plain payload.
Tool B uses a base36 suffix, added timeout-minutes: 6 and the environment matrix within hours of its first run on September 28, and modifies the selected payload per repository.
On October 19, Tool B added echo X | base32 -w 120 between the dumps, which prints LAFA==== as a separator, likely for the operator's log parser. Hours later it pushed a second job, sync-host, with runs-on: self-hosted, apparently only to repositories with a registered self-hosted runner. It writes three helper files (.gdmp_pat, .gdmp_patg, .gdmp_sweep) and logs each stage under a ===== gdmp-pivot: <stage> ===== header:
Host details and crontab.
A recursive search of the home directory, workspace and system paths for 31 token formats (including keys for AI providers such as Anthropic, Hugging Face, Groq and NVIDIA), private keys, .env files, Terraform state and shell history.
The environment of every process, from /proc/*/environ.
Through the Docker socket, a container with the host's root filesystem mounted, to repeat the search on the host.
AWS instance-role credentials, plus GCP and Azure metadata.
GitHub Actions and GitLab runner credential files.
The Kubernetes service account token.
However, this job is buggy: it looks for the wrong runner key file, its URL-credential regex is broken, and it doesn't collect GCP or Azure tokens.
GitHub's approval hold and private repositories
Since July 28, 2026, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them. Every public Gheist run we checked, across all variants including the self-hosted job, sits at action_required. The control worked, and the malicious payloads never ran.
Unfortunately, that hold doesn't apply to private repositories or GitHub Enterprise Server. There, GitHub audit logs show runs on ci-sync-* branches completing and then being deleted by the gheist user agent. CloudTrail shows the organizations' own workflows running on those branches and assuming AWS roles, which proves Actions executed without approval.
For defenders, that last signal finds Gheist without any GitHub logs, as shown below.
Other activity on the same accounts
This campaign is leveraging compromised GitHub access. The same accounts are used by other actors and campaigns, which demonstrates how compromised credentials can move throughout the threat actor ecosystem. We've observed overlaps with the following campaigns:
Lure repositories (malware distribution). On October 6, 391 accounts renamed about 1,461 repositories to cracked-software lures like fl-studio-crack and solana-sniper-lite. The rename wiped 610 ci-sync branches as a side effect. 166 of these accounts never appear in Gheist activity, so the pool is larger than Gheist's footprint.
Free compute (cryptomining). On October 18, 25 Gheist accounts each created a "Windows RDP Runner" repository within nine minutes, attempting to abuse GitHub Actions for free compute cycles.
PolinRider. Some victims appear to be infected with PolinRider, the DPRK-linked malware that hides JavaScript in build config files and force-pushes back-dated commits. On October 19 and 20, three victims re-pushed their Gheist commits with a loader appended to vite.config.js behind hundreds of whitespace characters, and in two cases an api.js that package.json runs before every dev and build.
Megalodon. 57 accounts from Gheist's first phase were also victims of Megalodon in May.
The credential sources we could trace fit this picture: infostealer logs, and tokens exposed in earlier supply-chain compromises such as the Trivy compromise in March.
Note: Gheist is distinct from GhostAction, which uses different workflow files and exfiltrates secrets to 193.32.204[.]199.
Which actions should security teams take?
Hunt
Look for branches named ci-sync- followed by six random characters, where the only change is a new file at .github/workflows/sync-check.yml with the commit message ci: sync config.
In GitHub audit logs, look for workflow runs on ci-sync-* branches that were deleted within a minute of completing, and for any activity from the user agent gheist.
If your workflows authenticate to the cloud with OIDC, check cloud audit logs for role assumptions or token exchanges whose subject includes a ci-sync- branch. That shows GitHub Actions ran on an attacker branch, even if you don't collect GitHub logs.
On self-hosted runners, look for the files .gdmp_pat, .gdmp_patg and .gdmp_sweep, and the string gdmp-pivot in job logs.
Respond
Rotate every repository, organization and environment secret available to an affected repository. Deleting the run or the branch doesn't undo the exposure.
Revoke the tokens that pushed the commits, and check their owners' devices for infostealers.
If a ci-sync branch ran on a self-hosted runner, treat the host and its instance role as compromised.
Don't approve held sync-check runs, and don't run code from ci-sync branches.
Harden. Require reviewers on environments with production secrets, scope OIDC trust policies to protected branches or environments, use GitHub Apps or short-lived fine-grained tokens instead of personal access tokens, and run self-hosted runners as ephemeral hosts without Docker socket or unrestricted metadata access.
Indicators of compromise
User agent gheist
Branch ci-sync- followed by six characters, matching ^ci-sync-[0-9a-z]{6}$
Commit message ci: sync config adding only .github/workflows/sync-check.yml
The Threat Center advisory includes an Event Explorer query covering planted commits, Gheist activity in GitHub audit logs and cloud role assumptions from attacker branches. Wiz Defend detects the activity with rules including "New Workflow Completed And Deleted In Short Time Span", "Workflow Pushed With Secret Dump" and "Commit Created With Known Malicious Commit Message".
Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Auto-fetched and translated by AI Atlas. All rights belong to the original author.