Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
Check whether your data has leaked
- Have I Been Pwned: check for free whether your email address is in past breaches (the FBI also contributes leaked passwords)
- Google Password Checkup: checks passwords saved in Google for leaks, reuse and weakness, and suggests changes
| Source | The Hacker News |
|---|---|
| Fetched | 10/26/2026, 06:23 PM |
| Data | Markdown JSON |
On 10/26/2026, 04:49 PM, The Hacker News published "Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs" (type: Security news). Related technologies: GitHub, GitHub Actions.