Gheist Group Exploits Stolen GitHub Tokens in Massive Repository Hijack

Security researchers have uncovered a coordinated campaign by the threat actor known as Gheist, which leveraged compromised GitHub personal access tokens to launch automated secret‑stealing workflows across more than 13,500 branches and repositories.

Personal access tokens (PATs) on GitHub function as password‑like credentials that grant the holder the same rights as the associated user account. When a token is stolen, an attacker can clone private code, push malicious changes, or trigger GitHub Actions with the same privileges as the legitimate owner.

In this operation, the attackers used the stolen tokens to create or modify GitHub Actions workflows that silently harvested environment variables, API keys, and other sensitive data embedded in repository settings. The malicious jobs were designed to run on the targeted branches, collect the secrets, and exfiltrate them to external servers under the attackers’ control.

The campaign was first highlighted by Infosecurity Magazine after GitHub’s internal security team detected anomalous workflow activity and unusual token usage patterns. Analysts traced the activity back to a set of tokens that had been obtained from previously compromised developer accounts and from credential‑dumping services on the dark web.

GitHub responded by revoking the compromised tokens, notifying affected repository owners, and publishing guidance on how to remediate the breach. The platform also accelerated the rollout of fine‑grained personal access tokens, which allow users to limit the scope of each token to specific repositories or actions.

While no public disclosure has confirmed that the stolen secrets were used in further attacks, the potential exposure includes cloud service keys, database passwords, and other credentials that could be leveraged in supply‑chain compromises or ransomware campaigns.

Security experts recommend that developers rotate any PATs that may have been exposed, enable token expiration where possible, adopt the principle of least privilege for token scopes, and enforce two‑factor authentication on all accounts. Monitoring for unexpected GitHub Actions runs and reviewing token audit logs are also advised.

The incident underscores a growing trend of attackers targeting software‑development platforms to harvest credentials at scale. As organizations increasingly rely on automated CI/CD pipelines, the security of token management has become a critical component of the broader software supply‑chain defense strategy.

Going forward, GitHub has signaled plans to introduce additional safeguards, such as mandatory token expiration policies and more granular permission controls, to curb the misuse of compromised credentials and to reduce the attack surface for similar campaigns.