---
title: Hunt: Gheist in your GitHub org: ci-sync-xxxxxx branches, runs deleted within a minute, the "gheist" user agent, and cloud role assumptions from attacker branches | ctxsec
url: https://ctxsec.com/items/hunt-gheist-ci-sync-branches-oidc
description: ""
status: "hunt guidance from Wiz Research IOCs (Oct 25)"
published: 2026-10-25
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-gheist-ci-sync-branches-oidc.md)

hunt guidance from Wiz Research IOCs (Oct 25)

2026-10-25

### Hunt: Gheist in your GitHub org: ci-sync-xxxxxx branches, runs deleted within a minute, the "gheist" user agent, and cloud role assumptions from attacker branches

1. **Branches:** names matching `^ci-sync-[0-9a-z]{6}$` whose only change adds `.github/workflows/sync-check.yml` with commit message `ci: sync config`. The commit is unsigned and authored as the token owner.
2. **Audit log:** workflow runs on `ci-sync-*` branches deleted within about a minute of finishing, and any request with user agent `gheist`. Also watch for many repos cloned by one token minutes before the branch appears.
3. **No GitHub logs? Use the cloud:** if workflows use OIDC, search AWS CloudTrail (or GCP/Azure equivalents) for role assumptions or token exchanges whose subject contains `ci-sync-`. That proves Actions ran on an attacker branch.
4. **Self-hosted runners:** files `.gdmp_pat`, `.gdmp_patg`, `.gdmp_sweep` and the string `gdmp-pivot` in job logs. If found, treat the host and its instance role as compromised.
5. **Workflow content:** `toJSON(secrets) }}' | base32 -w 120`, and from Oct 19 the separator output `LAFA====`. Workflow blob SHAs include `f3da2b8b357dcda02fd455d314be2a95007516a6` (plain) and `d09535857a741bbb976bdc084a9a021713133291` (timeout variant).

**Harden:** require reviewers on environments that hold production secrets, scope OIDC trust to protected branches or environments, swap personal access tokens for GitHub Apps or short-lived fine-grained tokens, and run self-hosted runners as ephemeral hosts without the Docker socket or open metadata access. Don't approve held `sync-check` runs.

Sources: [Wiz Research: Gheist, attempted scaled abuse of stolen GitHub tokens stumbles (Oct 25)](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles)