Wiz Research tracks Gheist campaign planting secret-dumping workflows through stolen GitHub tokens

Since September 15, 2026, Wiz Research has tracked an automated campaign named Gheist that involves mass abuse of compromised GitHub tokens to inject secret-dumping workflows into repositories.

The campaign plants a workflow named sync-check in every repository the stolen tokens can reach, aiming to print repository secrets into its own log. Gheist runs without a command-and-control server, which lets it evade detection methods that watch for outbound connections. Wiz Research named the campaign after the gheist user agent that identifies the tool’s API requests.

Each attack creates a branch named ci-sync- followed by six random characters, then commits .github/workflows/sync-check.yml to that branch. The workflow writes secrets into logs in base32 encoding to bypass GitHub’s verbatim masking, which hides secrets that appear exactly as written, and a job matrix targets environment-scoped secrets to expand the range of stolen credentials.

More than 850 compromised accounts hosted over 13,500 planted branches, Wiz Research found. Targeted accounts range from personal projects to enterprise organizations. Within enterprise environments, the tool rotates among users’ tokens and automation accounts in minutes, a movement Wiz researchers described as rapid lateral motion. The tool compromises private repositories and GitHub enterprise environments even though GitHub blocks exploitation in public repositories.

A security control put in place July 28, 2026, holds potentially malicious workflows in public repositories pending approval.

Researchers identified two parallel variants distinguished by branch-name suffixes. The first variant uses a hexadecimal suffix, and the second uses a base36 suffix. Tool B was first observed on September 28, 2026, and within hours began modifying its payload per repository to adapt to specific targets.

On October 19, 2026, the second variant added a job called sync-host that targets repositories running self-hosted runners. The job relies on a Docker socket to mount the host’s root filesystem.

The second variant employs aggressive host-level reconnaissance. It repeats a search across 31 token formats, with keys for Anthropic and Hugging Face among them. It also covers Groq and NVIDIA keys.

It also looks for Terraform state, shell history, and .env files while trying to collect credentials such as AI provider keys and cloud metadata. “An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach,” Wiz Research said.

The campaign also overlaps with other efforts such as Lure repositories, cryptomining, PolinRider, and Megalodon. Wiz Research said this illustrates how compromised credentials circulate through the threat actor ecosystem.

GhostAction is a separate campaign that has also targeted hundreds of GitHub repositories, and it relies on malicious workflows to exfiltrate secrets. While distinct from Gheist, GhostAction shares the same reliance on harmful workflows to steal data.

A burst of activity on October 8, 2026, affected 346 repositories linked to the accounts henrywoo and kitao. The activity touched both active projects and repositories that had been dormant.

According to Socket, over 500 GitHub accounts committed malicious workflows to tens of thousands of repositories beginning October 7, 2026. Socket described the scope as massive across the platform.

Attackers behind GhostAction use fetch-depth: 0, which fetches the entire Git history, to scan complete Git histories for credentials. The campaign targets historical data as well as current files, looking for secrets that may have been deleted in the past. The campaign exfiltrates data through cleartext HTTP POST requests to 193.32.204[.]199, sending stolen information to attacker-controlled infrastructure over an unencrypted protocol.

The exfiltration runs through workflows titled Security Audit and GitHub Actions Security, which target CI/CD secrets, cloud, AI, and SaaS credentials.

When AWS identifiers start with AKIA or ASIA, the GhostAction payload collects two lines of surrounding context. It targets AWS credentials and tries to grab the accompanying secret keys. “The absence of abuse so far is not evidence that the credentials are safe” StepSecurity said.