Cloud Security Firm Wiz Discloses 'Gheist' Attack: Stolen GitHub Tokens Used to Inject Malicious Workflows in 850+ Accounts, Private Repos Lack Protection
Wiz discovered attackers using stolen GitHub tokens to inject malicious Actions workflows. New GitHub approval mechanisms for public repos do not cover private repos or Enterprise Server, leaving enterprise environments vulnerable to credential theft.
US-based cloud security firm Wiz Research recently disclosed an attack campaign named "Gheist," where hackers abused stolen GitHub access tokens to inject malicious GitHub Actions workflows into code repositories, attempting to steal sensitive data. Researchers found that the campaign affected over 850 compromised GitHub accounts, with more than 13,500 malicious branches planted in related repositories.
Wiz has been tracking the Gheist activity since September 15, 2026, and observed signs continuing through October 24. GitHub previously introduced protection mechanisms for public repositories requiring manual approval for certain suspicious workflows, meaning the malicious workflows checked by researchers failed to execute in those contexts. However, this protection does not apply to private repositories or GitHub Enterprise Server. Wiz noted that malicious workflows successfully executed in some enterprise environments.
The injected malicious GitHub Actions workflows encoded accessible environment variables and secrets into logs during execution, bypassing GitHub's existing secret masking mechanisms. The attack tool then called the GitHub API to download these logs and deleted the execution records within seconds to hide traces. Attackers also attempted to search for potentially stored private keys and cloud service authentication credentials from the compromised organizations' self-hosted GitHub Actions runners.
In some enterprise environments, researchers found that attackers used stolen GitHub tokens to unauthorizedly copy private repositories. Hours later, usage records appeared showing queries to AWS Secrets Manager resources using the same organization's cloud service authentication credentials. Wiz researchers told cybersecurity media outlet Dark Reading that they estimated approximately 12 companies were affected by this wave of attacks.