An automated campaign uses stolen GitHub tokens to make private repositories print their own secrets, then deletes the evidence. Here is who is at risk.
Attackers are using stolen GitHub login tokens to make private code repositories reveal their own passwords and keys, then erasing the traces. Cloud security company Wiz calls the campaign Gheist. It has worked against private repositories and GitHub Enterprise environments, and as of October 24 it was still running.
A token is a digital key that lets software act as a GitHub user. With a stolen one, the attackers' tool adds a new branch to each repository the token can reach. The branch is named ci-sync- followed by six random characters. It holds one file, sync-check.yml, which starts an automated job.
That job prints every secret it can read, scrambled in a format called base32. GitHub normally hides secrets in its logs, but its own documentation says that is not guaranteed once a value has been changed. The tool downloads the log and deletes the run seconds later. Because the secrets leave through GitHub itself, there is no attacker server to block.
Anyone with write access to a repository can read every secret stored in it, according to GitHub. A stolen token with that access is enough. Secrets often include cloud keys, such as AWS credentials, and some are tied to production systems.
Wiz has recovered more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to enterprise organizations. It does not say how many organizations had secrets exposed. In some enterprise cases, cloud credentials from the same organization were used hours later to look through AWS Secrets Manager. Wiz does not say where those credentials came from or who used them.
Since July 28, GitHub has held suspicious workflow runs until someone with write access approves them. Every public Gheist run Wiz checked was still waiting, so its payload never ran. But the hold applies only to public repositories on github.com. Private repositories and GitHub Enterprise Server are not covered, and the hold only catches runs GitHub flags.
The alert box above lists the steps. The key point is that deleting the planted branch does not undo anything. Every secret the repository could read has to be replaced, and the token that pushed the branch has to be revoked.
The tokens come from sources such as infostealer logs, which are malware that steals saved logins, and from earlier attacks like the March compromise of the Trivy scanner. Other attackers use the same accounts. Some victims also appear to carry PolinRider, malware that researchers have linked to North Korea.
Around October 19, one version of the tool began targeting self-hosted runners, the machines organizations run themselves to process GitHub jobs. Wiz calls that job buggy and reports no successful run. The campaign is still changing, and about two-thirds of the accounts involved are no longer available on GitHub.
If your private code is on GitHub, check for ci-sync- branches now, and replace every secret a stolen token could have read.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartOtto, a new customer-tracking app for field sales teams, lets reps speak their notes instead of typing them. Price and launch details are not yet known.
Read more: Otto launches a sales app you talk to instead of typing
