Wiz says a campaign it calls Gheist has planted secret-printing workflows on more than 13,500 branches, and GitHub’s hold on suspicious runs does not cover private repositories or GitHub Enterprise Server.
Cloud security company Wiz says an automated campaign is using stolen GitHub tokens to push a single workflow file to a new branch in every repository the token can reach. The workflow prints the repository’s secrets into the GitHub Actions log in an encoded form that slips past GitHub’s log masking; the attackers download the log and delete the run seconds later. Wiz says it has recovered more than 13,500 planted branches from more than 850 compromised accounts since tracking began on 15 September, and the campaign was still running as of 24 October. GitHub’s hold on potentially malicious workflow runs stopped every public-repository run Wiz checked, but Wiz says that hold does not apply to private repositories or GitHub Enterprise Server; GitHub’s July announcement of the hold says it covers public repositories on github.com only. Teams that find a branch named “ci-sync-” followed by six characters should rotate every secret the repository could read and revoke the token that pushed it.
Sources: Wiz Research · The Hacker News · GitHub Changelog