Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
检查你的信息是否已泄露
- Have I Been Pwned：免费查询你的邮箱地址是否出现在过去的泄露数据中（FBI 也提供泄露的密码）
- Google 密码检查：检查保存在 Google 中的密码是否泄露、重复使用或强度不足，并建议更改
| 来源 | The Hacker News |
|---|---|
| 获取时间 | 2026/10/26 18:23 |
| 数据 | Markdown JSON |
2026/10/26 16:49，The Hacker News 发布了“Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs”（类型：安全新闻）。相关技术：GitHub、GitHub Actions。