Wiz Research said on 25 October 2026 that since 15 September it has been tracking a campaign it calls Gheist, which performs mass abuse of compromised GitHub tokens; the name comes from the user agent gheist that the attackers' tool sends with its GitHub API requests.

According to Wiz, for each repository a token can reach, the tool creates a branch named ci-sync- plus six random characters and commits .github/workflows/sync-check.yml with the message 'ci: sync config'; the workflow prints the repository's secrets, base32-encoded, into its own log (Wiz says GitHub masks secret values only when they appear verbatim, so the encoded secrets print in full), and the tool then downloads the log through the GitHub API and deletes the run seconds later.

Wiz says that because the secrets leave through GitHub's own API, there is no attacker domain or outbound connection to block, and that when a repository has deployment environments the tool also prints environment-scoped secrets, often production credentials.

Wiz says it has recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organisations' private repositories. Since 28 July 2026 GitHub has held potentially malicious workflow runs until a collaborator with write access approves them; GitHub's changelog says this protection currently applies to public repositories on github.com only and that GitHub Enterprise Server doesn't add it at this time.

Wiz says every public Gheist run it checked was held and the payloads never ran, but that it has observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments: in enterprise organisations it saw the tool cycle through tokens of several users and automation accounts within minutes, clone private repositories before planting the workflow, and, hours later, cloud credentials from the same organisation used to enumerate AWS Secrets Manager. On 19 October one variant of the tool added a second job for self-hosted runners that searches the machine for 31 token formats, private keys, .env files and AWS instance-role credentials; Wiz describes that job as buggy.

Wiz says roughly two-thirds of the implicated accounts are no longer available on GitHub, which it says likely indicates response activity, as it reported the campaign to GitHub. The credential sources Wiz could trace were infostealer logs and tokens exposed in earlier supply-chain compromises such as the Trivy compromise in March, and Wiz says Gheist is distinct from the GhostAction campaign. Primary: Wiz Research; wire: The Hacker News (26 Oct).