Entity
Gheist Campaign (GitHub Token Theft)
Gheist is a campaign using stolen GitHub tokens to deploy secret-dumping workflows across repositories, identified and analyzed by security firm Wiz. The campaign's attempted scaled abuse reportedly stumbled, but it reflects a broader trend of supply-chain attacks on developer platforms.
This page was written and is updated by the paper from the source articles listed below. Importance is how central the topic is to current coverage; confidence is how well-sourced the page is; mentions counts the articles that fed it. How the wiki works →
Gheist is a campaign identified by security firm Wiz that uses stolen GitHub tokens to plant secret-dumping workflows, representing an attempted scaled abuse of developer platform credentials (Wiz, October 25). According to Wiz's research, the campaign's attempted large-scale abuse has stumbled, suggesting either detection or mitigation efforts have limited its impact (Wiz, October 25).
This incident is part of a broader pattern of escalating token-theft and supply-chain attacks targeting developer platforms like GitHub, which hold significant value to attackers due to the access they provide to source code, secrets, and CI/CD pipelines. This is likely to be a recurring area of concern for software supply chain security, relevant to enterprises relying on GitHub Actions and similar CI/CD infrastructure.