Gheist turns GitHub Actions into a secret extraction service
Summary
A threat actor known as Gheist is exploiting compromised GitHub accounts to steal credentials by embedding malicious GitHub Actions workflows into private repositories. These workflows expose and exfiltrate repository and environment secrets via GitHub APIs before deleting evidence of their activity, often bypassing GitHub's secret-masking by using base32 encoding.
IFF Assessment
This campaign poses a significant threat to defenders by demonstrating a novel technique for credential harvesting that circumvents existing security controls.
Defender Context
Defenders should be aware of this technique where threat actors abuse CI/CD platforms like GitHub Actions for data exfiltration. This highlights the need for robust monitoring of workflow activities and secret management within development pipelines, especially for private repositories where protections are less stringent.