# GitHub supply chain cyberattacks > Live situation record from CLSTR: https://clstr.news/situations/github-supply-chain-cyberattacks > Updated: 2026-10-25T17:55:33.000Z. Sources: 3. Developments: 2. Security researchers have identified large-scale cyberattacks targeting the GitHub developer platform through the manipulation of software repositories and automated workflows. Initial reports from Socket indicated that since October 7, 2026, over 500 compromised accounts were used to inject malicious code into tens of thousands of repositories via manipulated GitHub Actions workflows. The primary objective of these attacks was to steal sensitive credentials, such as cloud infrastructure access keys and AI service keys, by transmitting data to a hardcoded IP address. Subsequent findings by Wiz Research identified a specific campaign named ‘Gheist’ that had been active since September 15, 2026. This campaign utilized stolen tokens to commit a ‘sync-check’ workflow to accessible repositories. This workflow was designed to print repository secrets into workflow logs, which attackers then downloaded via the GitHub API before deleting the runs to evade detection. While GitHub implemented controls for public repositories, the campaign successfully targeted private and enterprise environments by using GitHub’s own API for exfiltration, bypassing traditional security measures that look for external outbound connections. ## Timeline ### 2026-10-25: Wiz Research identifies Gheist GitHub token abuse campaign The Gheist campaign uses compromised GitHub tokens to print repository secrets into workflow logs and exfiltrate them via the GitHub API, affecting over 850 accounts. 3 sources. https://clstr.news/cluster/wiz-research-identifies-gheist-github-token-abuse-campaign ### 2026-10-09: GitHub accounts compromised in large-scale malicious code injection Over 500 compromised GitHub accounts have been used to inject malicious workflows into tens of thousands of repositories to steal cloud and AI credentials. 3 sources. https://clstr.news/cluster/github-accounts-compromised-in-large-scale-malicious-code-injection --- Cite as: GitHub supply chain cyberattacks. CLSTR, https://clstr.news/situations/github-supply-chain-cyberattacks