'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

A campaign dubbed Gheist is reported to use stolen GitHub tokens to expose secrets from developer repositories through GitHub Actions logs.

• One report describes an ongoing supply-chain attack harvesting credentials and sensitive data from thousands of developer repositories.· 1 source
• The campaign uses stolen GitHub tokens to plant workflows that print repository secrets in GitHub Actions logs, which attackers then download.· 1 source
• The report says attackers delete the workflow runs and that the method has succeeded in private repositories and GitHub Enterprise.· 1 source