Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Summary
An automated campaign is exploiting stolen GitHub tokens to insert malicious workflows into private repositories. These workflows print sensitive repository secrets into GitHub Actions logs, which attackers then harvest before deleting the evidence. The attacks have been successful in both private repositories and GitHub Enterprise environments.
IFF Assessment
This campaign represents a sophisticated attack method that allows adversaries to exfiltrate sensitive secrets from private code repositories, posing a direct threat to defenders.
Defender Context
This attack highlights the critical importance of securing GitHub tokens and understanding how attackers can leverage them to exfiltrate secrets. Defenders should implement strict access controls, regularly audit token usage, and be vigilant for unusual workflow activity within their CI/CD pipelines.