Source: Wiz Research's security advisory authored by Rami McCarthy and Hila Ramati, published on October 25, 2026.
Telemetry tracked by Wiz confirms the Gheist campaign began active operations on September 15, 2026, systematically cycling through stolen personal access tokens and automation credentials. For every accessible repository, the tool generated an unsigned commit under the token owner's identity, adding `.github/workflows/sync-check.yml` to trigger execution on push.
The attack weaponized architectural nuances in GitHub Actions. Although the workflow declared empty permissions (`permissions: {}`), this directive only constrains the temporary `GITHUB_TOKEN`, leaving repository and organizational secret contexts completely accessible. By piping environment dumps into `base32 -w 120`, the script circumvented GitHub's string-matching log sanitizers, which only mask raw secret values matching stored credentials.
A second variant identified on October 19 introduced a dedicated `sync-host` job targeting repositories equipped with self-hosted runners. This payload dropped investigative scripts (`.gdmp_pat`, `.gdmp_patg`, `.gdmp_sweep`) to parse crontab files, inspect `/proc/*/environ`, interrogate the Docker socket for container breakouts, and harvest credentials for 31 distinct cloud and AI providers, including Anthropic, Groq, NVIDIA, and Hugging Face.
Threat actor cross-pollination indicates the compromised credentials originated from infostealer logs and historic supply-chain exposures such as the March Trivy breach. Approximately 391 implicated accounts were concurrently abused to distribute cracked software lures, while 25 accounts spawned cryptocurrency mining runners within minutes of token ingestion.
What remains uncertain is the full perimeter of cloud assets compromised following successful token extractions. While Wiz reported that roughly two-thirds of implicated GitHub accounts have been decommissioned, lateral movement via stolen AWS instance roles and OIDC tokens may persist in downstream enterprise networks.