Threat reportSupply ChainTL-2026-4423
Gheist: Automated Campaign Abusing Stolen GitHub Tokens to Plant Secret-Exfiltrating Workflows
Gheist: Automated Campaign Abusing Stolen GitHub Tokens to (TL-2026-4423), also tracked as Gheist, is a high-severity supply-chain compromise, first published 2026-10-25. It has no confirmed attribution, affects GitHub GitHub Actions (private repositories and GitHub Enterprise, maps to 17 MITRE ATT&CK techniques (T1027.013, T1036, T1057), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4423
- Threat ID
- TL-2026-4423
- Also known as
- Gheist
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, cloud services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
Malware and tooling: PolinRider
How Gheist: Automated Campaign Abusing Stolen GitHub Tokens to works
Wiz Research tracks 'Gheist', an automated campaign that uses compromised GitHub tokens to push ci-sync-[6 chars] branches containing .github/workflows/sync-check.yml, which dumps repository secrets and environment variables base32-encoded to bypass log masking. Wiz recovered 13,500+ planted branches across 850+ compromised accounts; GitHub's approval hold on public-repo workflow runs (since 2026-07-28) blocked execution, but private repositories and GitHub Enterprise Server are not covered.
Gheist is an automated campaign, tracked by Wiz Research since 2026-09-15, that abuses stolen GitHub tokens (sourced primarily from infostealer logs and earlier supply-chain compromises such as the March 2026 Trivy incident and the May 2026 Megalodon campaign) to push unsigned commits authored as the token owner. Each commit has the message 'ci: sync config', lands on a branch matching ^ci-sync-[0-9a-z]{6}$ (hexadecimal suffix in the earlier 'Tool A', base36 in 'Tool B'), and adds a single file, .github/workflows/sync-check.yml. The API activity carries the user agent 'gheist'.
The workflow triggers on push and runs 'env | base32 -w 120' and 'echo -n ${{ toJSON(secrets) }} | base32 -w 120'. Base32 encoding defeats GitHub's log secret masking, and the operator retrieves the logs through the GitHub API. The workflow run and the branch are then deleted within seconds, leaving a short-lived audit trail. Tool B adds a 6-minute timeout, a matrix across deployment environments to capture environment-scoped secrets, and (from 2026-10-19) '===== gdmp-pivot: <stage> =====' and 'LAFA====' separator markers. No attacker C2 domains or IPs were identified: exfiltration relies on GitHub's own infrastructure and API.
On 2026-10-19 Tool B gained a second job, 'sync-host', that runs on self-hosted runners. It collects host details and crontab, searches home, workspace and system paths for 31 token formats (including Anthropic, Hugging Face, Groq and NVIDIA AI provider keys, private keys, .env files, Terraform state and shell history), enumerates /proc/*/environ, abuses the Docker socket to mount the host root filesystem, queries AWS instance-role, GCP and Azure metadata, and collects GitHub Actions/GitLab runner credential files and Kubernetes service-account tokens. Wiz notes bugs in this job (wrong runner key path, broken URL-credential regex, incomplete GCP/Azure token collection). It leaves .gdmp_pat, .gdmp_patg and .gdmp_sweep marker files.
Scale: Wiz recovered 13,500+ planted branches across 850+ compromised accounts, ranging from personal projects to enterprise private repositories; about two-thirds of the implicated accounts had been removed by 2026-10-24. GitHub's 2026-07-28 control, which holds potentially malicious workflow runs in public repositories for collaborator approval, stopped payload execution in every public-repository case Wiz tested. The hold does not apply to private repositories or GitHub Enterprise Server, and CloudTrail evidence shows successful execution in private repositories (OIDC role assumptions from ci-sync-* branches).
The same accounts show related abuse: on 2026-10-06, 391 accounts renamed ~1,461 repositories to cracked-software lures (wiping 610 ci-sync branches as a side effect); on 2026-10-18, 25 accounts created 'Windows RDP Runner' repositories within nine minutes (free-compute abuse); and between 2026-10-19 and 2026-10-20 three victims had Gheist commits re-pushed with a PolinRider JavaScript loader appended to vite.config.js. 57 first-phase accounts were also Megalodon victims. GhostAction is described as a distinct campaign.
MITRE ATT&CK techniques used in TL-2026-4423
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036 Masquerading
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
Initial Access
T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain
Collection
Impact
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.003 Shell History; T1552.004 Private Keys; T1552.005 Cloud Instance Metadata API; T1552.007 Container API
Exfiltration
T1567 Exfiltration Over Web Service
Privilege Escalation
Affected products and versions in Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
- GitHub — GitHub Actions (private repositories and GitHub Enterprise Server)
Vulnerable versions: Private repositories and GitHub Enterprise Server, where the workflow approval hold does not apply
Fixed in: Public repositories protected by the 2026-07-28 approval hold - GitHub — Self-hosted Actions runners
Vulnerable versions: Persistent runners with Docker socket access or unrestricted metadata access
Remediation for Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
Patches
- No CVE or vendor patch; GitHub's 2026-07-28 workflow approval hold covers public repositories only
Immediate actions
- Rotate all secrets (repository, organization and environment) in any repo where a ci-sync-* branch or sync-check.yml run executed
- Revoke commit-pushing tokens and scan the token owners' devices for infostealers
- Treat self-hosted runner hosts as compromised if a ci-sync job ran on them; hunt for .gdmp_pat, .gdmp_patg, .gdmp_sweep and 'gdmp-pivot' in job logs
- Deny approvals on held sync-check workflow runs and quarantine ci-sync-* branches
- Hunt GitHub audit logs for user agent 'gheist', branch creation matching ^ci-sync-[0-9a-z]{6}$ and runs deleted within minutes of completion
Workarounds
- Restrict who can push branches and create workflows in private repositories and GitHub Enterprise Server
- Deploy branch protection/rulesets blocking creation of unreviewed .github/workflows changes
Longer-term hardening
- Use GitHub Apps or short-lived fine-grained tokens instead of personal access tokens
- Run self-hosted runners as ephemeral, without Docker socket access or unrestricted metadata access
- Require reviewers on environments holding production secrets
- Scope OIDC trust policies to protected branches/environments only
- Alert on CloudTrail (or equivalent) OIDC role assumptions whose subject references a ci-sync- branch
Weaknesses (CWE) in Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
Timeline of Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
- Trivy GitHub Actions supply-chain compromise by TeamPCP exposes CI/CD secrets; Wiz lists it as one source of tokens later abused by Gheist
- Megalodon campaign pushes malicious workflows to 5,500+ GitHub repositories; 57 Gheist first-phase accounts were later found to be Megalodon victims
- GitHub begins holding potentially malicious workflow runs in public repositories for collaborator approval; not applied to private repositories or GitHub Enterprise Server
- Wiz Research begins tracking Gheist ci-sync branch activity
- Tool B variant (base36 branch suffix, 6-minute timeout, environment matrix) first observed
- 391 accounts rename ~1,461 repositories to cracked-software lures, wiping 610 ci-sync branches as a side effect
- 25 Gheist accounts create 'Windows RDP Runner' repositories within nine minutes (free-compute abuse)
- Tool B adds gdmp-pivot/LAFA==== separators and a self-hosted 'sync-host' job harvesting 31 token formats, Docker socket and cloud metadata
- Between 2026-10-19 and 2026-10-20, three victims re-push Gheist commits with a PolinRider loader appended to vite.config.js
- Wiz assesses that about two-thirds of the implicated accounts have been removed; 13,500+ branches across 850+ accounts recovered
- Wiz Research publishes the Gheist analysis and hunt guidance (Threat Center advisory wiz-adv-2026-186)
Sources cited for Gheist: Automated Campaign Abusing Stolen GitHub Tokens to
- Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles (Wiz Research)
- Megalodon: Mass CI/CD Pipeline Poisoning via GitHub Actions (CSA Research Note)
- Megalodon: Mass GitHub Repo Backdooring via CI Workflows (SafeDep)
- Trivy GitHub Actions Supply Chain Compromise: How TeamPCP Turned a Security Scanner Into a Credential Stealer (Phoenix Security)
- Trivy Supply Chain Attack: What You Need to Know (Aqua Security)
- GhostAction Campaign: 3,325 Secrets Stolen (GitGuardian)
- GhostAction Campaign (StepSecurity)
- GhostAction Campaign (Wiz Cloud Threat Landscape)
Detection coverage for TL-2026-4423
As of 2026-10-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4423 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.