Gheist Campaign Abuses Stolen GitHub Tokens to Exfiltrate Secrets Through Actions Logs
RedSide Security October 26, 2026 Cybersecurity 6 views
A Wiz analysis describes an automated campaign that uses stolen GitHub tokens to plant workflows printing repository secrets into Actions logs, which attackers download before deleting the runs — succeeding in private repos and GitHub Enterprise.
Continue reading: Gheist Campaign Abuses Stolen GitHub Tokens to Exf…
