‘Gheist’ Campaign Hijacks GitHub Accounts to Drain Secrets From Build Logs
Researchers have uncovered an ongoing campaign dubbed ‘Gheist’ that used stolen tokens to compromise more than 850 GitHub accounts and plant over 13,500 malicious workflows, dumping private repository secrets into build logs that attackers later downloaded and erased from view.
Security researchers say a campaign they’ve named “Gheist” has turned GitHub’s own automation tools into a large‑scale data exfiltration channel, compromising hundreds of accounts and quietly siphoning secrets from private repositories.
According to their findings, attackers used stolen GitHub tokens to gain access to more than 850 accounts. Once inside, they created or modified over 13,500 workflow branches in GitHub Actions, inserting steps that caused repository secrets to be written into job logs.
When these malicious workflows ran, sensitive data such as environment variables and access credentials were exposed in the logs. The attackers then downloaded the logs and deleted the workflow runs, making it harder for victims to spot what had happened.
The Gheist operation shows how build and deployment automation has become a prime target. GitHub Actions workflows often have broad permissions and access to secrets needed for testing and releases. By abusing that trust, attackers didn’t need to breach running production systems; they let the pipeline itself collect the information for them.
Separate research highlighted a related weakness in developer setups that lean on AI coding tools. In a real‑world incident described by investigators, a malicious file placed in a developer’s Downloads folder tried to trick an AI coding agent into installing malware. In controlled tests, an agent based on Codex ran the malware in more than 90% of attempts, after being steered by instructions hidden in a file named AGENTS.md.
For development teams, the risks are direct. A compromised GitHub token can allow adversaries to push code changes, tamper with builds or plant backdoors. If secrets leak via build logs, attackers may gain keys to cloud services, databases or internal APIs without touching the main codebase.
The scale reported — 850+ accounts and 13,500+ branches — indicates that Gheist is not a one‑off intrusion but a systematic attempt to harvest credentials and access across many organisations. It also suggests that a single developer’s compromised machine or token can become the starting point for a much broader supply‑chain exposure.
Key steps for organisations now include rotating GitHub tokens, reviewing workflow histories for unexpected changes, locking down which workflows can access secrets, and tightening how AI coding agents interact with local files and instructions. Evidence that credentials stolen in Gheist are later used in unrelated breaches, or that similar techniques are being aimed at other code‑hosting platforms, would indicate that this campaign is part of a wider shift in attacker tradecraft.
Sources
- OSINT