An automated campaign called Gheist has been using stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs, which the attackers then download and delete. This has affected private repositories and GitHub Enterprise environments.
Earlier attacks and coverage
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (2026-10-24)
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release (2026-10-22) - The Hacker News
Business impact
Organizations face the risk of exposed secrets, potential unauthorized access to cloud resources, and reputational damage. Legal and operational disruptions may occur if sensitive data is compromised.
Industries affected
All industries using GitHub, particularly those with private repositories and GitHub Enterprise environments.
Users affected
Users with write access to GitHub repositories are affected, as they can read every secret configured in the repository. This includes developers, project managers, and IT professionals.
