Automated 'Gheist' campaign plants secret-stealing GitHub workflows

An automated attack campaign that security vendor Wiz has named "Gheist" is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach, according to research published by Wiz on 25 October 2026. Wiz said the campaign uses no command-and-control server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.

The target is GitHub Actions, GitHub's built-in automation service that runs scripted jobs — called workflows — whenever code is pushed or other events occur in a repository. Those jobs routinely have access to repository secrets, the stored credentials and API keys that build pipelines need to publish packages, deploy software or talk to cloud accounts. A workflow added by an attacker inherits that access, which is what makes the technique attractive to anyone holding a valid token.

According to Wiz, the campaign works at scale and without human steering. Stolen GitHub tokens are used to enumerate whatever repositories the credential can reach, and a secret-dumping workflow is written into each one. Wiz describes the activity as automated rather than hand-operated, and says the campaign is still changing as it runs.

The absence of a command-and-control server is the detail most likely to matter to defenders. Traditional intrusion campaigns call home to attacker-run infrastructure, which gives network defenders a domain or IP address to block and threat intelligence teams something to track. Wiz says Gheist does not use one, so exfiltrated data leaves by other means. That removes a common detection and takedown point, and it means blocklists built around malicious infrastructure are unlikely to help.

Wiz also says the campaign has stumbled. In its assessment, recent security improvements made by GitHub have significantly disrupted the operation. The research does not, in the material published, attribute the campaign to any named group, and nothing in Wiz's summary identifies the victims or the number of repositories affected.

The incident fits a pattern that security teams running automated build systems will recognise: the credential is the perimeter. A token that can write to a repository can write a workflow, and a workflow is an agent that runs with the repository's privileges on the vendor's infrastructure. Once stolen tokens are in circulation, the automation that makes continuous integration useful is also what makes an intrusion scale across hundreds of projects without further attacker effort.

Organisations that use GitHub Actions and suspect token exposure would be looking for workflow files they did not author, and for recent changes to the jobs that already exist. Wiz's write-up is the only published account of the campaign so far, and it describes the activity as ongoing and evolving.