Wiz Research said on October 25 that a campaign it calls Gheist has abused stolen GitHub tokens since September 15, 2026. A token is a key to an account. The attackers use each one to add a workflow file named sync-check to every repository it can reach. The workflow dumps the repository's secrets into its own log. The tool then reads the log through GitHub's API and deletes the run. Wiz counted more than 850 compromised accounts and over 13,500 attacker branches.
GitHub hides a secret in logs only when its exact text appears. The workflow re-encodes secrets in base32, so they print in full. Its permission limits cover only the built-in job token, not the secrets. Secrets tied to deployment environments, often production credentials, print too. A GitHub control added on July 28 holds risky public-repository runs until a collaborator signs off. Wiz said every public run it checked was held. Private repositories and GitHub Enterprise Server have no such hold, and Wiz saw attacks succeed there.
The split matters. A safeguard that covers only public code leaves private repositories exposed. Here, a stolen token was enough to reach a repository's secrets. Wiz recommends GitHub Apps or short-lived fine-grained tokens over personal access tokens, and self-hosted runners that reset after each job.