Wiz Research identifies Gheist GitHub token abuse campaign

Wiz Research has identified a cyberattack campaign named ‘Gheist’ that has been abusing compromised GitHub tokens since September 15, 2026. The campaign involves the mass exploitation of stolen tokens to access repositories, ranging from personal projects to enterprise-level private environments.

The attack functions by committing a specific workflow, named ‘sync-check’, to every repository accessible by a compromised token. This workflow is designed to print a repository’s secrets into its own workflow logs. The attackers then use the GitHub API to download these logs and immediately delete the run to hide their tracks.

Researchers have recovered over 13,500 planted branches from more than 850 compromised accounts. While GitHub has implemented controls to block exploitation in public repositories, the campaign has successfully targeted private repositories and GitHub enterprise environments. The attack is noted for its ability to bypass traditional security measures by using GitHub’s own API for data exfiltration, meaning there is no external attacker domain or outbound connection for security tools to block.