Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
- Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens.
- The attack commits a workflow named sync-check to every repository to which each token has access.
- The workflow seeks to print the repository's secrets into its own workflow log.
Unverified
- Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens.
- The attack commits a workflow named sync-check to every repository to which each token has access.
- The workflow seeks to print the repository's secrets into its own workflow log.
Sources: Wiz