A sophisticated cyber campaign, dubbed Gheist, has been exploiting stolen GitHub tokens to infiltrate private repositories and GitHub Enterprise environments. According to research by cloud security firm Wiz, the attackers use these tokens to create malicious workflows that exfiltrate sensitive information from a repository's GitHub Actions logs. This campaign has compromised over 850 accounts, affecting both personal and enterprise projects. The workflow operates by pushing a new branch with a distinct name and committing a file that triggers a process to extract secrets, which are then stored in the logs and downloaded by the adversaries. Although GitHub has implemented measures to pause suspicious workflows in public repositories, these safeguards do not extend to private ones, leaving them vulnerable. The Gheist operation, which has been active since mid-September, involves the rapid cycling of tokens to clone and exploit private repositories before deleting traces of the workflow runs. The campaign also targets self-hosted runners, searching for credentials but reportedly has not succeeded due to technical flaws in the tool. The attackers have used various sources for the stolen tokens, including previous supply chain attacks and infostealer logs. GitHub's current security measures, while effective for public repositories, do not cover the vulnerabilities exploited in this ongoing campaign.