Gheist：企图大规模滥用被窃的GitHub Tokens Stumbles
一项自动化的运动是在每一个被盗的GitHub信使能够到达的存储处安装秘密倾倒工作流程。 它使用没有C2服务器，正在积极演化，并被最近的GitHub安全改进所严重干扰。
自2026年9月15日起，Wiz Research开始追踪Gheist：进行大规模滥用已受损的GitHub令牌的新活动。 攻击对每个信使可以访问的每个寄存器执行一个名为同步检查的工作流程。 工作流程试图将寄存器的秘密打印到自己的工作流程日志中。 然后，该工具通过GitHub API下载日志，并随后删除运行秒。 该工具的API请求载有用户agent gheist，它给出了运动的名称。
我们从850多家受损账户，从个人项目到企业组织的私人储存库，追回了13 500多家植入的分支机构。
最近的GitHub控制已经阻止了公共仓库的开发，但我们观察到在私人仓库和GitHub企业环境中成功的开发与后续活动。
截止10月24日：
攻击正在进行中
大约2⁄3个涉入账户已无法在GitHub上找到。 这很可能表明反应活动，因为我们已向GitHub报告这一活动。
如何发动攻击
对于每个寄存器，工具会创建一个名为ci-sync-外加6个随机字符的分支，然后将.github/workflows/sync-check.yml与消息ci：同步配置。 承诺没有署名，并被写成"象征"的主人。 推动事件触发了工作流程：
GitHub只在日志中逐字显示时才会将秘密值遮住。 一个基数32-编码后的秘密不相匹配，所以印出满分。
虽然权限：QQ限制任务GITHUB TOKEN，攻击者不需要，但并不限制秘密背景。
当一个寄存器有部署环境时，该工具会将它们列在一个带有环境的工作矩阵中：${{ 矩阵。 Environment QQ，所以环境范围的秘密，经常是生产证书，也会被打印出。
由于这些秘密会通过GitHub自己的API离开，因此没有攻击者域或外出连接来阻断。
在企业组织中，我们看到工具循环在几分钟内通过几个用户的代号以及自动化账户，在植入工作流程前克隆出私人寄存器，数小时后，同一组织的云证用来列举AWS秘密管理员。
有效载荷是如何演变的
这种攻击的两个变体被平行地观测到。 它们可以通过分支名区分。
工具A使用十六进制后缀和普通有效载荷。
工具B使用一个基数36后缀，添加了超时分钟：6和在9月28日首次运行后的数小时内的环境矩阵，并修改了每个存储处所选的有效载荷。
10月19日，工具B在垃圾堆之间添加回声X-QQ Base32-w 120，这印出LAFA====作为分隔符，很可能是操作员的日志解析器。 几个小时后，它推了第二个工作，即同步主机，与跑步：自我托管，显然只到一个注册的自我托管跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑跑它会写出三个帮助文件(.gdmp pat,.gdmp patg,.gdmp sweep)，并在QQ gdmp-pivot: <state>下记录每个阶段。 QQ 标题：
主机细节和crontab。
对主目录，工作空间和系统路径进行递归性搜索，可获取31个令牌格式(包括Anthropic,Hugging Face,Groq和NVIDIA等AI供应商的密钥)，私钥，.env文件，Terraform状态和 shell历史。
每个过程的环境，来自/proc/ */环境。
通过 Docker 套接字，装有主机根文件系统的容器，在主机上重复搜索。
AWS实例-作用证书，外加GCP和Azure元数据。
GitHub动作和GitLab跑跑证书文件。
Kubernetes服务账户代币。
然而，这个工作是buggy的：它寻找错误的跑车密钥文件，它的URL-信用Regex被打破，它不收集GCP或Azure的令牌。
GitHub的核准持有量和私人存放量
自2026年7月28日起，GitHub在公共存放所内举办了潜在的恶意工作流程跑会，直到合作者批准。 包括自办工作在内的所有变体都坐在需要的动作上控制有效恶意有效载荷从未运行过
不幸的是，这个控件不适用于私人寄存器或GitHub企业服务器。 在那里，GitHub审计日志显示在ci-sync-*分支上运行完成后被gheist用户agent删除。 CloudTrail 显示是各组织自己在这些分支上运行的工作流程，承担了AWS的角色，这证明了未经批准而执行的行动。
对于维权者来说，最后一个信号发现 Gheist没有任何GitHub日志，如下所示。
同一账户上的其他活动
这一运动正在利用损害GitHub接入的机会。 其他行为者和运动也使用同样的说法，这表明在威胁行为者的生态系统中，信誉如何受损。 我们观察到与以下运动的重叠：
露蕾寄存器(疟疾分发). 10月6日，391个账户重新命名了大约1,461个寄存器，用于像f-studio-crack和Solana-sniper-lite等被破解的软件诱骗。 重名会将610个ci-sync分支擦去作为副作用。 其中166个账户从未出现在Gheist活动中，因此池子比Gheist的足迹要大。
自由计算(cryptomining). 10月18日，25个Gheist账户在9分钟内分别创建了"Windows RDP Runner"寄存器，试图为自由计算周期而滥用GitHub Actions.
宝林瑞德。 一些受害者似乎感染了与朝鲜相关的恶意软件PolinRider，该恶意软件将JavaScript隐藏在构建配置文件中，并且强制-pushes背出日期。 10月19日和20日，三名受害者用装填器重新加压了他们的Gheist。 相会。 js 后数百个白空字符，在两起案例中，api.js 该软件包.json 运行在每一个dev和构建之前。
兆龙。 盖斯特第一阶段的57个说法也是5月梅加洛通的受害者。
我们可以追踪到的可靠来源符合这张照片：信息化日志，以及3月的Trivy妥协等早期供应链妥协中暴露的标志。
注：Gheist不同于Ghost Action，它使用不同的工作流程文件并过滤出秘密到193.32.204[.]199.
安全小组应采取什么行动？
韩特
查找名为 Ci- sync - 的分支，然后是6个随机字符，其中唯一的变化是在.github/workflows/ sync-check.yml与承诺消息 ci：同步配置。
在GitHub审计日志中，查找在完成后一分钟内被删除的ci-sync-*分支上的工作流程，以及用户agentgheist中的任何活动。
如果您的工作流程以 OIDC 认证到云中，请检查云审计日志中的角色假设或对象包括 Ci- sync- 分支的符号交换。 显示 GitHub Actions运行在攻击者分支上，即使你不收集GitHub日志。
在自办的跑取器上，查找文件：.gdmp pat,.gdmp patg和.gdmp sweep，以及工作日志中的字符串gdmp-pivot.
响应
旋转每个存放处、组织和环境机密，供受影响的存放处使用。 删除跑道或分行不会解除曝光。
撤销推动犯罪的证据检查他们所有者的装置
如果一个Ci-sync分支运行在自备跑跑者身上，则将主机及其实例角色视为失密。
不要批准进行同步检查并且不要从CI -sync分支运行代码
汉登。 要求审查有生产秘密的环境，范围OIDC对被保护分支或环境的信任政策，使用GitHub Apps或短寿命的精细纹饰来代替个人访问标志，并在没有Docker套接字或不受限制的元数据访问的情况下作为电平主机运行自营跑者。
妥协指标
用户 agent 光学
分行 Ci- sync - 后有6个字符，匹配 ^ Ci- sync- [0-9a-z]{6} $
提交消息 ci：同步配置只添加。 github/ work flows/ sync- check.yml
威胁中心咨询包括事件探索者查询，涵盖被埋设的承诺、GitHub审计日志中的Gheist活动和攻击者分支的云作用假设。 Wiz Defense通过包括"新工作流程完成并删除了在短时间中","工作流程被秘密倾斜所推动"和"承诺以已知恶意提交消息"在内的规则来检测活动。
Wiz Research正在追踪一个使用ARTEX的演员，与Storm-0940重叠，跨越多个目标软件供应商。 学习AI agent如何攻击Okta,Entra，和Cognitto，以及它在日志中留下了什么。
获得个性化演示
准备好看到Wiz行动了吗？
"我见过最好的用户体验，为云量工作提供了充分的能见度".
戴维·埃斯特里克科
"Wiz提供一面玻璃以观察我们的云层环境".
亚当·弗莱彻首席警卫
"我们知道，如果Wiz识别出一些关键的东西，它实际上是。"
Greg Poniatowski 威胁和脆弱性管理主任
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has access. The workflow seeks to print the repository's secrets into its own workflow log. Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent gheist, which gives the campaign its name.
We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories.
A recent GitHub control has been blocking the exploitation in public repositories, but we've observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments.
As of October 24:
the attack is ongoing and evolving
roughly ⅔ of implicated accounts are no longer available on GitHub. This likely indicates response activity, as we have reported this activity to GitHub.
How the attack works
For each repository, the tool creates a branch named ci-sync- plus six random characters, then commits .github/workflows/sync-check.yml with the message ci: sync config. The commit is unsigned and authored as the token's owner. The push event triggers the workflow:
GitHub masks secret values in logs only when they appear verbatim. A base32-encoded secret doesn't match, so it prints in full.
While permissions: {} restricts the job's GITHUB_TOKEN, which the attacker doesn't need, it doesn't restrict the secrets context.
When a repository has deployment environments, the tool lists them in a job matrix with environment: ${{ matrix.environment }}, so environment-scoped secrets, often production credentials, are printed too.
Because the secrets leave through GitHub's own API, there is no attacker domain or outbound connection to block.
In enterprise organizations, we saw the tool cycle through tokens of several users and automation accounts within minutes, clone private repositories before planting the workflow, and hours later, cloud credentials from the same organization used to enumerate AWS Secrets Manager.
How the payload evolved
Two variants of this attack have been observed in parallel. They can be distinguished via the branch names.
Tool A uses a hexadecimal suffix and the plain payload.
Tool B uses a base36 suffix, added timeout-minutes: 6 and the environment matrix within hours of its first run on September 28, and modifies the selected payload per repository.
On October 19, Tool B added echo X | base32 -w 120 between the dumps, which prints LAFA==== as a separator, likely for the operator's log parser. Hours later it pushed a second job, sync-host, with runs-on: self-hosted, apparently only to repositories with a registered self-hosted runner. It writes three helper files (.gdmp_pat, .gdmp_patg, .gdmp_sweep) and logs each stage under a ===== gdmp-pivot: <stage> ===== header:
Host details and crontab.
A recursive search of the home directory, workspace and system paths for 31 token formats (including keys for AI providers such as Anthropic, Hugging Face, Groq and NVIDIA), private keys, .env files, Terraform state and shell history.
The environment of every process, from /proc/*/environ.
Through the Docker socket, a container with the host's root filesystem mounted, to repeat the search on the host.
AWS instance-role credentials, plus GCP and Azure metadata.
GitHub Actions and GitLab runner credential files.
The Kubernetes service account token.
However, this job is buggy: it looks for the wrong runner key file, its URL-credential regex is broken, and it doesn't collect GCP or Azure tokens.
GitHub's approval hold and private repositories
Since July 28, 2026, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them. Every public Gheist run we checked, across all variants including the self-hosted job, sits at action_required. The control worked, and the malicious payloads never ran.
Unfortunately, that hold doesn't apply to private repositories or GitHub Enterprise Server. There, GitHub audit logs show runs on ci-sync-* branches completing and then being deleted by the gheist user agent. CloudTrail shows the organizations' own workflows running on those branches and assuming AWS roles, which proves Actions executed without approval.
For defenders, that last signal finds Gheist without any GitHub logs, as shown below.
Other activity on the same accounts
This campaign is leveraging compromised GitHub access. The same accounts are used by other actors and campaigns, which demonstrates how compromised credentials can move throughout the threat actor ecosystem. We've observed overlaps with the following campaigns:
Lure repositories (malware distribution). On October 6, 391 accounts renamed about 1,461 repositories to cracked-software lures like fl-studio-crack and solana-sniper-lite. The rename wiped 610 ci-sync branches as a side effect. 166 of these accounts never appear in Gheist activity, so the pool is larger than Gheist's footprint.
Free compute (cryptomining). On October 18, 25 Gheist accounts each created a "Windows RDP Runner" repository within nine minutes, attempting to abuse GitHub Actions for free compute cycles.
PolinRider. Some victims appear to be infected with PolinRider, the DPRK-linked malware that hides JavaScript in build config files and force-pushes back-dated commits. On October 19 and 20, three victims re-pushed their Gheist commits with a loader appended to vite.config.js behind hundreds of whitespace characters, and in two cases an api.js that package.json runs before every dev and build.
Megalodon. 57 accounts from Gheist's first phase were also victims of Megalodon in May.
The credential sources we could trace fit this picture: infostealer logs, and tokens exposed in earlier supply-chain compromises such as the Trivy compromise in March.
Note: Gheist is distinct from GhostAction, which uses different workflow files and exfiltrates secrets to 193.32.204[.]199.
Which actions should security teams take?
Hunt
Look for branches named ci-sync- followed by six random characters, where the only change is a new file at .github/workflows/sync-check.yml with the commit message ci: sync config.
In GitHub audit logs, look for workflow runs on ci-sync-* branches that were deleted within a minute of completing, and for any activity from the user agent gheist.
If your workflows authenticate to the cloud with OIDC, check cloud audit logs for role assumptions or token exchanges whose subject includes a ci-sync- branch. That shows GitHub Actions ran on an attacker branch, even if you don't collect GitHub logs.
On self-hosted runners, look for the files .gdmp_pat, .gdmp_patg and .gdmp_sweep, and the string gdmp-pivot in job logs.
Respond
Rotate every repository, organization and environment secret available to an affected repository. Deleting the run or the branch doesn't undo the exposure.
Revoke the tokens that pushed the commits, and check their owners' devices for infostealers.
If a ci-sync branch ran on a self-hosted runner, treat the host and its instance role as compromised.
Don't approve held sync-check runs, and don't run code from ci-sync branches.
Harden. Require reviewers on environments with production secrets, scope OIDC trust policies to protected branches or environments, use GitHub Apps or short-lived fine-grained tokens instead of personal access tokens, and run self-hosted runners as ephemeral hosts without Docker socket or unrestricted metadata access.
Indicators of compromise
User agent gheist
Branch ci-sync- followed by six characters, matching ^ci-sync-[0-9a-z]{6}$
Commit message ci: sync config adding only .github/workflows/sync-check.yml
The Threat Center advisory includes an Event Explorer query covering planted commits, Gheist activity in GitHub audit logs and cloud role assumptions from attacker branches. Wiz Defend detects the activity with rules including "New Workflow Completed And Deleted In Short Time Span", "Workflow Pushed With Secret Dump" and "Commit Created With Known Malicious Commit Message".
Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.