Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign uses stolen GitHub tokens to plant workflows that print repository-readable secrets into GitHub Actions logs. The attackers download the logs and then delete the workflow runs. According to the source, the attacks have succeeded in private repositories and GitHub Enterprise Server environments. Wiz has tracked the campaign since September 15 and reported that it was still running and changing as of October 24.