Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is leveraging stolen GitHub tokens to access private repositories and GitHub Enterprise environments. The attackers are using these tokens to create workflows that expose a repository's secrets in its GitHub Actions logs. They then download the logs containing the secrets before deleting the runs to cover their tracks. This tactic has been successful in compromising private repositories and GitHub Enterprise environments, as reported by cloud security company Wiz. A GitHub security feature is triggered in response to this activity, which pauses the workflow. The campaign's ability to bypass usual security measures has allowed it to steal sensitive information from targeted repositories.