Gheist Campaign Uses Stolen GitHub Tokens to Exfiltrate Private Repository Secrets

# Gheist Campaign Uses Stolen GitHub Tokens to Exfiltrate Private Repository Secrets

https://gcdradar.vercel.app/incidents/gheist-campaign-uses-stolen-github-tokens-to-exfiltrate-priv · AIR-2026-1530 · closed 2026-11-11

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world exploitation in private repositories and enterprise environments.
- Fix status: No fix needed
- First reported: 2026-10-26
- AI role: No AI role
- Products: GitHub Actions, GitHub

## Summary

An automated campaign dubbed Gheist exploits stolen GitHub tokens to inject workflows that dump private repository secrets into GitHub Actions logs. Attackers subsequently download the log data and delete the run traces before detection.

## What to do

Audit GitHub tokens, review workflow configurations, and rotate exposed repository secrets.

## Affected and fixed versions

- Affected: GitHub Enterprise
- Affected: GitHub Actions

## Latest updates

- 2026-10-26: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs (https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html)

## Sources

- 2026-10-26 The Hacker News: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
- 2026-10-26 Dark Reading: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets https://darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
- 2026-10-28 Dark Reading: GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub https://darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.