A campaign tracked by researchers as Gheist stole secrets from more than 850 GitHub accounts, planting over 13,500 branches to harvest credentials, Wiz Research reported on 25 October 2026. The campaign, tracked since 15 September, used stolen GitHub tokens to create branches named with a ci-sync- prefix plus six characters, and commit a sync-check workflow that printed secrets into Actions logs in base32 encoding to bypass GitHub's verbatim masking. The logs were then downloaded through GitHub's API and the runs deleted.

Why it worked

No GitHub flaw was broken: the attackers used valid tokens and ordinary platform features, and secrets left through GitHub's own API, so there was no attacker domain to block. A GitHub control shipped on 28 July 2026 blocked the checked public-repository runs, but private repositories and GitHub Enterprise Server remained exposed, with cloud roles assumed and cloud secrets enumerated.

Escalation and defences

On 19 October, a second variant added a sync-host job targeting self-hosted runners, hunting 31 credential formats including Anthropic, Hugging Face, Groq and NVIDIA keys, plus Kubernetes tokens and Docker host filesystems. By 24 October, roughly two-thirds of the implicated accounts were no longer available on GitHub after Wiz's report, but researchers said the campaign was still running and evolving. Defences: rotate reachable secrets, revoke pushing tokens, and hunt for ci-sync- branches and sync-check workflows.

Sources: Wiz Research via MSSP Alert; SecurityOnline, October 2026.