Wiz reports GitHub token campaign stealing secrets from private repositories

Wiz Research reported an ongoing campaign that uses stolen GitHub tokens to plant workflows that expose repository secrets. The researchers recovered more than 13,500 planted branches from more than 850 compromised accounts and observed successful exploitation in private repositories and GitHub enterprise environments. The campaign, named Gheist, encodes secrets so GitHub's log masking does not hide them, downloads workflow logs through GitHub's API and deletes the runs. Wiz also observed cloud credentials from an affected organization being used to enumerate AWS Secrets Manager. GitHub's approval control blocked every public-repository run Wiz checked, but the hold does not apply to private repositories or GitHub Enterprise Server.