alex lee (@alexlee20122022) on X

What it is

Gheist is a GitHub campaign that Wiz disclosed in October 2026, described in a thread by @alexlee20122022. Stolen GitHub tokens are used to push branches into every repo the token can reach, with the aim of stealing the secrets stored there. The thread counts 13,500+ planted branches and 850+ compromised accounts since 15 September, and says activity continued on 24 October. It says two thirds of the accounts are already gone from GitHub.

How it works

The attacker pushes a branch named ci-sync- plus six random characters, with a workflow called sync-check. The workflow prints every secret it can read into the run log. GitHub's log masking only catches values that appear exactly as stored, so the dump is base32-encoded first and the masking never fires. The attacker fetches the log through GitHub's API and the run deletes itself seconds later, so no attacker-controlled server is involved.

In enterprise intrusions Wiz saw private repos cloned first, several employees' tokens used up within minutes, and the attacker returning hours later with cloud keys to enumerate AWS Secrets Manager. A second payload targets self-hosted runners and loots the machine for more tokens and keys.

Preconditions / Affected

• You are affected if you use GitHub Actions or if the repo or its environments hold any keys, passwords or tokens. A repo with no Actions and no secrets has nothing to steal.
• Public repos are largely protected. Since 28 July GitHub holds suspicious workflow runs for human approval, and every public Gheist run Wiz checked is still waiting unrun.
• Private repos and GitHub Enterprise have no such hold, and the runs executed there.

What to do

Check once, now. The thread says it takes minutes.

• Look for a branch matching ci-sync- plus six characters, or a new .github/workflows/sync-check.yml with the commit message "ci: sync config".
• If a held sync-check run is waiting for approval, do not approve it. Approving is how the attack runs.
• In the audit log, look for runs on ci-sync branches that vanished within a minute, and API calls with user agent "gheist".
• If you use OIDC to AWS or another cloud, search cloud logs for role assumptions from a ci-sync branch.
• On self-hosted runners, look for files named .gdmp_pat, .gdmp_patg and .gdmp_sweep.

If you find anything:

• Rotate every secret the repo could reach, environment secrets included. Deleting the branch does not undo the theft.
• Revoke the token that pushed the commit.
• Check the token owner's machine for infostealer malware, which the thread names as where many of the tokens came from.

The thread's hardening advice is short-lived, narrowly scoped tokens and GitHub Apps in place of long-lived broad tokens.

Caveats

The thread is a secondary summary. The full indicator list and hardening guidance are in Wiz's report, which the thread links but this page does not reproduce. The claim that public-repo runs remain held rests on the runs Wiz checked.