# Gheist Campaign Exploits Stolen GitHub Tokens to Access Private Repository Secrets

*Published October 28, 2026*
*Source: [https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html](https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html)*

## Executive Summary

The Gheist campaign uses stolen GitHub tokens to extract secrets from private repositories by creating workflows that log sensitive information. This activity compromises both personal and enterprise accounts, highlighting vulnerabilities in private and GitHub Enterprise repositories.

## Article

A sophisticated cyber campaign, dubbed Gheist, has been exploiting stolen GitHub tokens to infiltrate private repositories and GitHub Enterprise environments. According to research by cloud security firm Wiz, the attackers use these tokens to create malicious workflows that exfiltrate sensitive information from a repository's GitHub Actions logs. This campaign has compromised over 850 accounts, affecting both personal and enterprise projects. The workflow operates by pushing a new branch with a distinct name and committing a file that triggers a process to extract secrets, which are then stored in the logs and downloaded by the adversaries. Although GitHub has implemented measures to pause suspicious workflows in public repositories, these safeguards do not extend to private ones, leaving them vulnerable. The Gheist operation, which has been active since mid-September, involves the rapid cycling of tokens to clone and exploit private repositories before deleting traces of the workflow runs. The campaign also targets self-hosted runners, searching for credentials but reportedly has not succeeded due to technical flaws in the tool. The attackers have used various sources for the stolen tokens, including previous supply chain attacks and infostealer logs. GitHub's current security measures, while effective for public repositories, do not cover the vulnerabilities exploited in this ongoing campaign.