The best heists in the movies never involve breaking into the vault. Somebody just walks in wearing the right uniform. A campaign Wiz calls "Gheist" pulls the same move on GitHub: with stolen tokens, attackers get your own CI pipeline to read your secrets aloud, then sweep up the evidence seconds later.

One Branch, One Workflow, Every Secret

Wiz has tracked the campaign since September 15, and as of October 24 it was still running and evolving. An automated tool uses stolen GitHub tokens to push a branch named ci-sync- plus six random characters, adding a single file, .github/workflows/sync-check.yml, with the innocent commit message "ci: sync config." The workflow prints the job's environment and every secret it can read, encoded in base32, which slips past GitHub's log masking because masking doesn't cover encoded values.

The tool then pulls the log through GitHub's API and deletes the run almost immediately. Since the data leaves through GitHub itself, there's no attacker server to block. Wiz recovered more than 13,500 planted branches from over 850 compromised accounts, including private enterprise repositories and GitHub Enterprise Server. Some versions even run a job per deployment environment, exposing environment-scoped secrets, which are often production credentials.

Your Tokens Are Someone Else's Skeleton Key

Where did the tokens come from? Infostealer logs and earlier supply-chain attacks, including March's compromise of the Trivy scanner. That's the chain reaction to understand: one compromised tool or one infected laptop yields tokens, those tokens yield CI secrets, and in some enterprise cases Wiz saw cloud credentials later used to enumerate AWS Secrets Manager. GitHub does hold suspicious workflow runs for approval, but only on public repositories on github.com, so private repos and Enterprise Server aren't covered.

The fix is to make tokens worth less. Swap personal access tokens for GitHub Apps or short-lived fine-grained tokens, require reviewers on environments holding production secrets, and limit OIDC trust policies to protected branches. If you're affected, rotate every secret the repo could reach and check token owners' machines for infostealers. Also hunt for ci-sync- branches and the gheist user agent in your audit logs.

Your CI pipeline is a vault, and right now some vaults are handing out the combination to anyone with the right badge.

Supply-chain attacks like this one are exactly why we put together our free developer's security checklist for defending against supply-chain attacks, so grab it before your next token goes walkabout.

Source: The Hacker News