TOPIC
Gheist campaign: stolen GitHub tokens, ci-sync branches, malicious Actions workflows, log-based secret exfiltration, public/private/GHES control boundaries, self-hosted runner pivot, follow-on cloud activity and attribution/denominator limits.
1
4
4
6
4
NEW — >13,500 planted branches across >850 compromised accounts reported; public github.com runs checked by Wiz blocked by GitHub hold, while private/enterprise execution and follow-on cloud activity observed. Total tokens/orgs/secrets, self-hosted realized impact, token provenance and actor identity remain unresolved.
CI_CD_IDENTITY_AND_WORKFLOW_SUPPLY_CHAIN
—
—
—
Gheist is a confirmed large-scale campaign abusing compromised GitHub identities to plant malicious Actions workflows across reachable repositories.
Provider-wide denominator and victim-organization mapping.
GitHub’s public approval hold materially disrupts Gheist in public github.com repositories; private repos/GHES have a different risk boundary.
Current control rollout/coverage changes and authoritative private/GHES telemetry.
Successful private/enterprise execution can expose repository/environment/cloud credentials and enable follow-on cloud access.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 4 Evidence
Wiz recovered >13,500 planted ci-sync-* branches from >850 compromised GitHub accounts. Stolen tokens push sync-check.yml, trigger Actions, base32-encode secrets to logs, retrieve/delete runs; successful private/enterprise execution and follow-on cloud activity observed; active/evolving as of Oct 24.
لا يثبت: Does not prove total tokens/orgs/secrets, universal execution, one upstream credential source, common actor across overlapping campaigns or downstream poisoned software releases.
GitHub’s July-28 control automatically holds potentially malicious Actions workflow runs in public github.com repositories until collaborator approval; GitHub states the control does not apply to GitHub Enterprise Server.
لا يثبت: Does not establish Gheist counts, private execution prevalence, secret theft or actor identity.
GitHub documents environment-secret access subject to protection rules, self-hosted runner isolation caveats, and incident-response guidance to treat credentials accessible to suspicious workflows as compromised and rotate them.
لا يثبت: Does not prove a specific Gheist execution, secret exposure or victim count.
Independent defensive analysis reproduces three disclosed workflow blob hashes and validates branch/file/commit/audit/cloud/self-hosted indicators; self-hosted workflow hash and campaign population telemetry are not independently reproduced.
لا يثبت: Does not independently validate campaign population, successful execution count, cloud outcome scale or actor attribution.
Victim-specific secret lineage/cloud audit correlation and denominator.
Self-hosted-runner targeting can expand exposure to host/cloud/Kubernetes credentials, but realized prevalence and collection success are unknown.
Runner endpoint telemetry, successful collection artifacts and follow-on logs.
Compromised identities come from a mixed credential-theft ecosystem; no one upstream breach/operator is established for all overlapping account activity.
Per-account token provenance and authoritative attribution.
AI developer platforms, CI/CD, release pipelines and extension/package ecosystems are adjacent credential-acquisition surfaces; distinct incidents remain distinct identities absent shared evidence.
Shared upstream credential/publisher/build lineage or authoritative attribution.
No authoritative public denominator for stolen tokens, affected organizations, reachable repositories, successful workflow executions or unique victims.
GitHub/provider telemetry plus organization-level incident data mapping accounts/tokens/repos/runs.
No public count of secrets successfully exfiltrated or downstream cloud actions attributable to Gheist across affected organizations.
Victim GitHub audit logs, workflow logs, cloud OIDC/role assumptions, secret-use telemetry and IR findings.
Per-account token origin and operator identity are unresolved; overlap with infostealers, Trivy exposure and other campaigns is insufficient for a single-source/single-actor claim.
Credential provenance, endpoint malware evidence, token audit history, shared infrastructure and authoritative attribution.
No reliable public denominator for self-hosted runner jobs that executed successfully or host/cloud/Kubernetes credentials actually collected.
Runner endpoint telemetry, successful job artifacts, cloud/Kubernetes audit evidence and victim/provider reports.
TOKEN_SOURCE_AND_ACTOR_ATTRIBUTION
SELF_HOSTED_RUNNER_REALIZED_IMPACT
فتح Run