Gheist campaign uses stolen GitHub tokens to dump secrets from private repos
- Vendor
- GitHub
An automated campaign that Wiz calls Gheist is using stolen GitHub tokens to commit a workflow that prints a repository’s secrets into its own log. The tool then downloads the log and deletes the run. Wiz has tracked it since Sep 15 and recovered more than 13,500 planted branches from more than 850 compromised accounts, including enterprise organizations’ private repositories. GitHub’s hold on suspicious runs blocks it in public repositories, but Wiz saw it succeed in private repositories and GitHub Enterprise environments.
For each repository a token can reach, the tool creates a branch named ci-sync- plus six characters and commits with the message “ci: sync config.” The workflow prints the repository’s secrets encoded in base32, which GitHub’s log masking doesn’t catch, and lists deployment environments so their secrets print too. The secrets leave through GitHub’s own API, so there’s no attacker domain to block, Wiz says.
In enterprise organizations, Wiz saw the tool cycle through the tokens of several users and automation accounts within minutes and clone private repositories before planting the workflow. Hours later, cloud credentials from the same organization were used to list secrets in AWS Secrets Manager. Since Oct 19, one variant also pushes a job for self-hosted runners, which searches the runner and, through the Docker socket, its host for tokens, keys and Terraform state. Wiz says that job is buggy and misses some credentials.
Since Jul 28, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them, and every public Gheist run Wiz checked is still waiting. The hold doesn’t apply to private repositories or GitHub Enterprise Server, where audit logs show the runs completing and then being deleted. Wiz says about two thirds of the accounts involved are no longer on GitHub, likely after it reported the activity.
Wiz traced the stolen tokens it could to infostealer logs and to tokens exposed in earlier supply chain compromises, such as Trivy’s in March. Wiz found the same accounts in other activity, including cracked software lures, cryptomining, the DPRK-linked PolinRider malware and the Megalodon campaign. Wiz says Gheist is distinct from GhostAction, which uses different workflow files.
- Vendor
- GitHub
What to do
8 steps
- 1 Search repositories for branches named ci-sync- plus six characters whose only change adds .github/workflows/sync-check.yml with the commit message “ci: sync config.”
- 7 Treat any self-hosted runner that ran a ci-sync- branch or holds .gdmp_pat, .gdmp_patg or .gdmp_sweep as compromised, along with its instance role.
Indicators
| Type | Value | Note |
|---|---|---|
| File name | Planted workflow, committed with the message “ci: sync config” | |
| File name | Helper file the self-hosted runner job writes | |
| File name | Helper file the self-hosted runner job writes | |
| File name | Helper file the self-hosted runner job writes | |
| SHA-1 | Git blob of the plain workflow | |
| SHA-1 | Git blob of the workflow with a timeout | |
| SHA-1 | Git blob of the workflow that prints a separator | |
| SHA-1 | Git blob of the workflow with the self-hosted runner job |
- File namePlanted workflow, committed with the message “ci: sync config”
- File nameHelper file the self-hosted runner job writes
- File nameHelper file the self-hosted runner job writes
- File nameHelper file the self-hosted runner job writes
- SHA-1Git blob of the plain workflow
- SHA-1Git blob of the workflow with a timeout
- SHA-1Git blob of the workflow that prints a separator
- SHA-1Git blob of the workflow with the self-hosted runner job
Timeline
- Jul 28GitHub starts holding potentially malicious workflow runs in public repositories for approval.
- Sep 15Wiz starts tracking Gheist.
- Sep 28A second variant of the tool first runs and within hours starts printing environment secrets.
- Oct 6391 accounts rename about 1,461 repositories to cracked software lures, wiping 610 Gheist branches.
- Oct 19The second variant adds the job for self-hosted runners.
- Oct 25Wiz publishes its report on Gheist.
Sources
- Wiz researchPrimary source wiz.io
- GitHub noticePrimary source github.blog