---
title: Gheist: stolen GitHub tokens used to push a "sync-check" workflow to 13,500+ branches that prints repo and environment secrets in base32, then deletes the run | ctxsec
url: https://ctxsec.com/items/gheist-stolen-github-tokens-sync-check-secrets-dump
description: ""
status: "confirmed (Wiz Research write-up, Oct 25); campaign ongoing as of Oct 24"
published: 2026-10-25
---

> 

[← Cybersecurity News](/news) · [markdown](/items/gheist-stolen-github-tokens-sync-check-secrets-dump.md)

confirmed (Wiz Research write-up, Oct 25); campaign ongoing as of Oct 24

2026-10-25

### Gheist: stolen GitHub tokens used to push a "sync-check" workflow to 13,500+ branches that prints repo and environment secrets in base32, then deletes the run

Since Sept 15, Wiz Research has tracked **Gheist**, named after the `gheist` user agent on its API calls. For every repository a stolen token can reach, it creates a branch `ci-sync-` plus six characters and commits `.github/workflows/sync-check.yml` (message `ci: sync config`). The push triggers a job that prints `env` and `toJSON(secrets)` through `base32`, which slips past GitHub's log masking because masking only catches secrets shown verbatim. The tool downloads the log through GitHub's API and deletes the run seconds later, so there's no attacker domain to block.

- **Scale:** over 13,500 planted branches from more than 850 compromised accounts, including private repositories in enterprise organizations. About two-thirds of the accounts are no longer on GitHub, likely after Wiz reported them.
- **Where it worked:** GitHub has held suspicious public-repo runs for approval since Jul 28, and every public Gheist run Wiz checked was stuck at `action_required`. That hold doesn't cover **private repositories or GitHub Enterprise Server**, where runs completed. In one organization, cloud credentials were used hours later to enumerate AWS Secrets Manager.
- **Escalation:** one variant adds deployment environments as a job matrix so production secrets print too. Since Oct 19 it also pushes a `sync-host` job to self-hosted runners that searches for 31 token formats (including AI provider keys), `.env` files, Terraform state, process environments, cloud metadata credentials and the Kubernetes service account token, and uses the Docker socket to reach the host. Wiz says this job is buggy.
- **Where the tokens came from:** infostealer logs and tokens exposed in earlier supply-chain compromises. The same accounts overlap with crack-software lure repos, cryptomining runners, DPRK-linked PolinRider and the May Megalodon campaign. Gheist is separate from GhostAction.

**Do:** rotate every repo, org and environment secret an affected repo could see (deleting the branch doesn't undo exposure), revoke the pushing tokens and check their owners for infostealers. See the [Gheist hunt](/items/hunt-gheist-ci-sync-branches-oidc).

Sources: [Wiz Research: Gheist, attempted scaled abuse of stolen GitHub tokens stumbles (Oct 25)](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles) · [GitHub changelog: Actions holds potentially malicious workflows for approval (Jul 28)](https://github.blog/changelog/2026-07-28-github-actions-holds-potentially-malicious-workflows-for-approval/)