Actor Profile

Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Enterprise environments. Attribution remains unclear, though infrastructure and victim overlap suggests connections to multiple threat ecosystems. Some compromised accounts show signs of PolinRider malware infection (linked to North Korean actors), and the stolen tokens trace to infostealer logs and prior supply-chain compromises including the March 2026 Trivy vulnerability scanner breach. The campaign demonstrates sophisticated automation and operational knowledge of GitHub Actions security boundaries.

TTPs (Tactics, Techniques, Procedures)

The campaign employs automated token abuse (T1528 Steal Application Access Token) to gain initial access. Attackers create branches named "ci-sync-" with six random characters and commit malicious workflow files (.github/workflows/sync-check.yml) to trigger GitHub Actions execution (T1204.003 User Execution: Malicious Image). The workflows exfiltrate secrets by printing them base32-encoded to bypass GitHub's log masking (T1027 Obfuscated Files or Information, T1552.001 Unsecured Credentials: Credentials In Files). Exfiltration occurs via GitHub's own API (T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage), eliminating need for attacker-controlled C2 infrastructure. The tool deletes workflow runs within seconds to remove evidence (T1070.004 Indicator Removal: File Deletion). A newer variant targets self-hosted runners to harvest 31 credential types including private keys, AWS instance role credentials, and Kubernetes service account tokens (T1552.004 Unsecured Credentials: Private Keys, T1552.005 Cloud Instance Metadata API). The campaign cycles through multiple compromised tokens within minutes and enumerates AWS Secrets Manager post-compromise (T1580 Cloud Infrastructure Discovery).

Targets & Patterns

Gheist targets software development and technology organizations with private GitHub repositories and GitHub Enterprise Server deployments. Wiz recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations. The campaign specifically exploits GitHub's security gap: while GitHub's suspicious workflow hold feature protects public repositories on github.com, it does not cover private repositories or GitHub Enterprise Server—the primary attack surface. The tool prioritizes repositories with deployment environments to access production credentials, which Wiz notes are often stored as environment-scoped secrets. The October 19 variant specifically targets organizations using self-hosted GitHub Actions runners, attempting to pivot to the underlying infrastructure. Victim overlap with the Megalodon campaign (May 2026) and accounts infected with PolinRider malware suggests targeting of the broader software supply chain ecosystem.

Historical Context

Gheist is distinct from but operates in a similar threat landscape as GhostAction, another GitHub Actions abuse campaign that GitGuardian observed running in public repositories until GitHub blocked it on October 9, 2026. The campaign shares victim overlap with Megalodon (May 2026), which also pushed secret-stealing workflows into thousands of repositories, with 57 accounts hit by both campaigns. Token sources trace to the March 2026 Trivy vulnerability scanner supply-chain compromise and various infostealer log repositories. On October 6, 2026, 391 accounts used by Gheist were also leveraged by separate attackers to rename 1,461 repositories as fake cracked software for malware distribution, wiping 610 Gheist branches in the process. Some victims show PolinRider malware infections, with three re-pushing Gheist commits on October 19-20 with added loaders in vite.config.js files. As of October 24, 2026, the campaign remained active and evolving, with approximately two-thirds of involved accounts no longer available on GitHub following Wiz's disclosure.

Defensive Recommendations

  • Audit GitHub repositories for branches matching pattern 'ci-sync-' followed by six random characters containing only .github/workflows/sync-check.yml with commit message 'ci: sync config'; rotate all repository secrets and revoke associated tokens immediately
  • Query GitHub audit logs for workflow runs on ci-sync-* branches that were deleted within one minute of completion, and for any activity associated with the 'gheist' user agent string
  • Review AWS CloudTrail logs for unexpected workflow executions that assumed AWS roles on suspicious branches, and enumerate AWS Secrets Manager access patterns for anomalous credential retrieval
  • Implement branch protection rules requiring signed commits and enforce approval workflows for all branches, including those in private repositories and GitHub Enterprise Server environments
  • Monitor self-hosted GitHub Actions runners for credential harvesting attempts targeting private keys, AWS instance metadata, Kubernetes service account tokens, and runner credential files; isolate runners with minimal necessary permissions and credential access