A malicious campaign known as Gheist targeted GitHub repositories by planting secret-stealing workflows across more than 13,500 branches, based on information published by Infosecurity Magazine.
Researchers at Wiz tracked the operation since Sept. 15, identifying over 850 compromised accounts. Attackers utilized stolen access tokens to create branches and inject GitHub Actions workflows designed to exfiltrate repository secrets into logs. These logs were retrieved via the application programming interface before the runs were deleted to avoid detection. While a GitHub security control implemented on July 28 successfully blocked these workflows in public repositories by requiring manual approval, private repositories and GitHub Enterprise Server environments remained vulnerable. In these private settings, attackers successfully executed workflows to harvest credentials, subsequently using them to enumerate Amazon Web Services Secrets Manager. The campaign also involved malware distribution and cryptomining activities. Although GitHub removed approximately two-thirds of the implicated accounts by Oct. 24 following reports, the researchers noted that the campaign continues to evolve. This incident highlights the significant risk posed by compromised tokens, which allow threat actors to weaponize legitimate automation features for credential theft, necessitating robust monitoring of both public and private development environments.
Source: Infosecurity Magazine
